From 186fe2061c54453bb1e1efd200a3a7e15680a421 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 06:29:01 -0400
Subject: [PATCH 01/19] feat(signin): move SAP ID to top of provider list

---
 hugo/layouts/signin.html | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hugo/layouts/signin.html b/hugo/layouts/signin.html
index 2078cdb88..1b4cf9ae2 100644
--- a/hugo/layouts/signin.html
+++ b/hugo/layouts/signin.html
@@ -31,6 +31,10 @@ <h1 id="signin-title" class="signin-title">Sign In</h1>
         chosen IdP (IAS prompt=login would force it, but the approuter does not
         forward prompt) — tracked as a follow-up.
       */}}
+      <a class="fd-button fd-button--emphasized signin-btn" data-signin-idp href="/login?sap_idp=sap.default">
+        <img class="signin-logo signin-logo--sap" src="/img/providers/SAP.svg" alt="" aria-hidden="true" width="20" height="20" />
+        <span>Continue with SAP ID</span>
+      </a>
       <a class="fd-button fd-button--transparent signin-btn" data-signin-idp href="/login?sap_idp=sap.custom,GitHub">
         <img class="signin-logo" src="/img/providers/Github.svg" alt="" aria-hidden="true" width="20" height="20" />
         <span>Continue with GitHub</span>
@@ -47,10 +51,6 @@ <h1 id="signin-title" class="signin-title">Sign In</h1>
         <img class="signin-logo" src="/img/providers/linkedin.webp" alt="" aria-hidden="true" width="20" height="20" />
         <span>Continue with LinkedIn</span>
       </a>
-      <a class="fd-button fd-button--emphasized signin-btn" data-signin-idp href="/login?sap_idp=sap.default">
-        <img class="signin-logo signin-logo--sap" src="/img/providers/SAP.svg" alt="" aria-hidden="true" width="20" height="20" />
-        <span>Continue with SAP ID</span>
-      </a>
     </div>
 
     {{/*

From ab92647746cab54d767fc37c30b82882344a2919 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 09:06:01 -0400
Subject: [PATCH 02/19] feat(signin): warn SAP-ID holders that a mismatched
 social login forks progress (#2651)

Users who already have an SAP ID but sign in with a non-matching social
provider resolve to a separate Users row; their progress, completions, and
Devtoberfest points don't carry over (root cause of #2651). Add a static
warning above the provider buttons steering SAP-ID holders to Continue with
SAP ID. Content-only, no JS.
---
 hugo/layouts/signin.html | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/hugo/layouts/signin.html b/hugo/layouts/signin.html
index 1b4cf9ae2..9735cbabc 100644
--- a/hugo/layouts/signin.html
+++ b/hugo/layouts/signin.html
@@ -14,6 +14,19 @@ <h1 id="signin-title" class="signin-title">Sign In</h1>
 
     <p class="signin-choose">Choose your authentication service:</p>
 
+    {{/*
+      SAP-ID guidance (issue #2651). Users who already have an SAP ID but sign in
+      with a social provider whose identity does not match it can be resolved to a
+      SEPARATE profile — their existing progress, completions, and Devtoberfest
+      points do not carry over. Steer SAP-ID holders to the SAP ID button. Static
+      content, always shown; no JS.
+    */}}
+    <p class="signin-sapid-note" role="note">
+      <strong>Already have an SAP ID?</strong> Use <strong>Continue with SAP ID</strong>.
+      Signing in with a social provider that doesn&rsquo;t match your SAP ID can create
+      a separate profile, and your existing progress and points won&rsquo;t carry over.
+    </p>
+
     <div class="signin-actions">
       {{/*
         Provider sign-in buttons, RPT-style (logo + label, full-width stacked).
@@ -214,5 +227,16 @@ <h1 id="signin-title" class="signin-title">Sign In</h1>
     margin: 1rem 0 0;
   }
   .signin-session-nudge a { color: var(--sapLinkColor, #0070f2); }
+  .signin-sapid-note {
+    font-size: 0.8125rem;
+    line-height: 1.4;
+    text-align: left;
+    color: var(--sapTextColor, #32363a);
+    background: var(--sapWarningBackground, #fef7f1);
+    border: 1px solid var(--sapWarningBorderColor, #e76500);
+    border-radius: 0.5rem;
+    padding: 0.625rem 0.875rem;
+    margin: 0 0 1rem;
+  }
 </style>
 {{ end }}

From 1e409761bd78ffdc6996fc65a15cfa3957df1dd7 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 09:49:37 -0400
Subject: [PATCH 03/19] =?UTF-8?q?docs(spec):=20identity=20dedup=20?=
 =?UTF-8?q?=E2=80=94=20resolve=20&=20reconcile=20duplicate=20Users=20rows?=
 =?UTF-8?q?=20(#2651)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../2026-10-05-identity-dedup-2651-design.md  | 71 +++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-10-05-identity-dedup-2651-design.md

diff --git a/docs/superpowers/specs/2026-10-05-identity-dedup-2651-design.md b/docs/superpowers/specs/2026-10-05-identity-dedup-2651-design.md
new file mode 100644
index 000000000..d9c11c419
--- /dev/null
+++ b/docs/superpowers/specs/2026-10-05-identity-dedup-2651-design.md
@@ -0,0 +1,71 @@
+# Identity dedup — resolve & reconcile duplicate `Users` rows (#2651)
+
+**Date:** 2026-10-05
+**Issue:** [#2651](https://github.com/sap-tutorials/tutorials-ims/issues/2651) — Kasimir cat-game points not reaching the Devtoberfest leaderboard
+**Status:** approved design → implementation
+
+## Problem
+
+The same human ends up with **multiple `Users` rows**, discriminated by **email** (not sapId). Confirmed against PROD (schema `2FEC…`, 817,333 Users):
+
+- **349 duplicate-email clusters / 719 rows** — the fork population.
+- **0 duplicate non-null sapIds** — forks are rows with *different* UUID sapIds for one human, not sapId collisions.
+- Cat-game impact: **137 users / 167 award rows / 835 points** stranded (awards on a row with no `EventRegistration`).
+
+### Mechanism
+
+Cat-game awards (`CatGameAwards`) are written keyed to the `Users.ID` the *current* login resolves to. The leaderboard (`GAMEBOARD_PARTICIPANT_V1`, an inner join to `EventRegistrations`) only credits a row that has a registration. When a login reaches the same human via a different IdP/claim set and lands on (or mints) a second row, new awards accrue there while the registration + history stay on the original row → the counter climbs but the leaderboard total is frozen.
+
+Reporter's data: two `Users` rows, same email, different UUID sapIds — Row A (older) 55 pts + registration (leaderboard-visible), Row B (newer, Oct) the recent catches, no registration. Both sapIds are UUIDs; reporter uses SAP ID only (no social) → this is **core resolution**, affecting SAP-ID-only users.
+
+### Root causes (from `packages/core/resolve-db-user.js`)
+
+1. **`provisionDbUser` create-path is not atomic and Tier-3 email merge is last/conditional.** `resolveUser` tiers are (iss,sub) → sapId → email. A social/IAS login provisions `sapId=null`; a later XSUAA/SAP-ID login for the same human misses Tier-1 (different iss,sub) and Tier-2 (different/null sapId), and Tier-3 only matches if `tokenEmail` is present and an existing row's email is populated — otherwise a **second row** is inserted. No DB uniqueness on `Users.sapId`; the direct `cds.db` INSERT bypasses `@assert.unique.sapId`.
+2. **No reconciliation for already-forked rows.** The legacy `mergeAccounts(primaryUuid, secondaryUuid)` (`srv/lib/account-merge.js`) is uuid-keyed and only repoints `TaskRecords`/`PrizeRecords`/`AccomplishmentRecords` — it ignores `CatGameAwards`, `EventRegistrations`, and `UserIdentities`, and never runs from the login path.
+
+## Decisions (approved)
+
+- **No DB unique constraint on `Users.sapId`** — historic data mess makes it risky, and DUP_SAPIDS=0 means it buys little. Prevention is application-level.
+- **Canonical row rule:** real/canonical sapId → else oldest `createdAt` → else lowest `legacyId`. **Override:** when the picked canonical differs from a row that holds an `EventRegistration`, merge *toward* the registered row so leaderboard identity is preserved. (Once consolidated the exact winner barely matters; this rule just makes it deterministic.)
+- **CatGameAwards on merge: SUM points, then apply the per-event 100 cap** — err generous (Tom's standing rule). Dedupe only to avoid double-counting the *same* `(event, awardDate)`, never to trim totals.
+- **#2 and #3 collapse into one prevention PR** — the social-login fork is the same mechanism as the P/S fork; eager email merge fixes both.
+
+## Design
+
+### Component 1 — Prevention (resolver hardening), PR A
+
+In `packages/core/resolve-db-user.js`:
+
+1. **Eager email merge before INSERT.** In `provisionDbUser`, after `resolveUser` returns null but before INSERT, if `tokenEmail(user)` is present and a non-GitHub-synthetic `Users.email` matches, reuse that row (write the (iss,sub) link via `writeIdentityLink`) instead of inserting. This promotes Tier-3's effect into the create path so a verified email never mints a duplicate.
+2. **Atomic get-or-create.** Perform the existence recheck (email + (iss,sub)) and INSERT inside one `cds.tx`. On a caught `unique|duplicate` (or a post-insert re-SELECT finding a now-existing row), return the existing row rather than the new one. Keeps concurrent first-logins from both inserting.
+3. **Deterministic canonical pick** replacing Tier-3's `candidates[0]` (line ~312): apply the canonical-row rule above, including the EventRegistration-preference override.
+
+No schema change. `@assert.unique.sapId` stays as the CAP-runtime check it already is.
+
+### Component 2 — Reconciliation (extend `mergeAccounts` + one-off job), PR B
+
+1. **Extend `mergeAccounts(primary, secondary)`** (`srv/lib/account-merge.js`) to additionally:
+   - Repoint `UserIdentities.user_ID` secondary→primary (dedupe on `(issuer,subject)` — drop a secondary link that duplicates a primary one).
+   - Repoint `EventRegistrations` secondary→primary, deduping on `@assert.unique.userEvent` (keep the earliest `joinedAt`).
+   - Merge `CatGameAwards`: repoint secondary→primary. On `(event, awardDate)` PK collision for the same day, keep a single row whose `points` = min(sum of the colliding rows' points, 5) — the daily 5-cap. After repointing, if an event's grand total exceeds 100, trim the most recent award rows until the event total == 100 (never below a user's legitimately-earned total). Favor keeping points.
+   - (Existing `TaskRecords`/`PrizeRecords`/`AccomplishmentRecords` repoint unchanged.)
+2. **Canonical selection** inside the batch driver uses the Component-1 rule, so `mergeAccounts` is always called with the correct primary.
+3. **One-off batch job** (`srv/jobs/`): walk the 349 email clusters, **dry-run first** (emit a report: clusters, rows, points before/after, cap-trims), then execute idempotently, recording each merge via the existing `SecondaryAccounts` `status:'MERGED'` pattern.
+
+### Delivery / sequencing
+
+- **PR A (prevention) → DEV first** — stops new forks.
+- **PR B (reconciliation) → DEV after A**; run dry-run against PROD data (via the gameboard-synonym / cf-env read path, see memory), review counts with Tom, then execute the merge job on PROD.
+
+## Testing
+
+- **Resolver (unit, in-memory SQLite):** concurrent-insert returns one row; verified-email match reuses the existing row (no insert); canonical pick order; EventRegistration-preference override; social-then-SAP-ID sequence converges to one row.
+- **Merge (unit):** `CatGameAwards` sum-with-cap (including an over-cap case that trims overflow); `EventRegistrations` userEvent dedupe keeps earliest; `UserIdentities` (iss,sub) dedupe; idempotent re-run is a no-op.
+- **Dry-run validation:** batch report reconciled against the 349 PROD clusters on hybrid before any PROD execution.
+- Follow the `srv-qa` cp-list audit if touching `srv/lib/` (CLAUDE.md) — confirm `account-merge.js` deps are in `.deploy/mta.yaml` `srv-qa` `cp`.
+
+## Out of scope
+
+- Social-login IAS/approuter config (separate #2552/#2506 work).
+- `/signin` warning (shipped, #2653).
+- Any `Users` schema change / DB constraint.

From 5eac0f6ffd5aa140c0818ca5f1b50282bd8dc495 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 10:00:50 -0400
Subject: [PATCH 04/19] docs(plan): identity dedup implementation plan (#2651)

---
 .../plans/2026-10-05-identity-dedup-2651.md   | 615 ++++++++++++++++++
 1 file changed, 615 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-10-05-identity-dedup-2651.md

diff --git a/docs/superpowers/plans/2026-10-05-identity-dedup-2651.md b/docs/superpowers/plans/2026-10-05-identity-dedup-2651.md
new file mode 100644
index 000000000..8c96c326e
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-05-identity-dedup-2651.md
@@ -0,0 +1,615 @@
+# Identity Dedup — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Stop the same human from forking into multiple `Users` rows, and reconcile the ~349 already-forked email clusters so cat-game points reach the leaderboard.
+
+**Architecture:** Application-level hardening of `provisionDbUser` (eager verified-email merge before INSERT + canonical-row selection), plus extending the existing uuid-keyed `mergeAccounts` to repoint `CatGameAwards`/`EventRegistrations`/`UserIdentities`, driven by a dry-run-first batch job over duplicate-email clusters. No DB schema change, no unique constraint.
+
+**Tech Stack:** CAP Node.js (`@sap/cds`), `cds.ql` / CQL only (no raw SQL in app code), Vitest/Mocha unit tests on in-memory SQLite.
+
+**Spec:** `docs/superpowers/specs/2026-10-05-identity-dedup-2651-design.md`
+
+## Global Constraints
+
+- Target branch: **DEV** (never main). PR A (prevention) merges before PR B (reconciliation).
+- Never write raw SQL in app code — use `cds.ql`/CQL (CLAUDE.md). Raw `db.run()` only where an existing pattern already requires it.
+- `CatGameAwards` merge: **sum points, clamp to per-event 100 cap / per-day 5 cap — err generous**, never trim below legitimately-earned total.
+- Canonical row rule: real/canonical sapId → else oldest `createdAt` → else lowest `legacyId`; **bias toward the row holding an `EventRegistration`**.
+- Canonical sapId test (verbatim): `sapId && !SCIM_UUID_RE.test(sapId) && !sapId.includes('@')` where `SCIM_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i`.
+- If touching `srv/lib/`, re-walk transitive `./` imports and confirm every dep is in `.deploy/mta.yaml`'s `srv-qa` `cp` list (CLAUDE.md).
+- Entities: `com.sap.developers.ims` → `Users` (ID, uuid, sapId, email, legacyId, createdAt), `UserIdentities` (user_ID, issuer, subject, provider, email), `CatGameAwards` (key user, key event, key awardDate, points), `EventRegistrations` (user_ID, event_ID, joinedAt; `@assert.unique.userEvent`).
+
+---
+
+## PR A — Prevention (resolver hardening)
+
+### Task 1: Eager verified-email merge before INSERT in `provisionDbUser`
+
+**Files:**
+- Modify: `packages/core/resolve-db-user.js` (`provisionDbUser`, ~lines 611-636)
+- Test: `test/unit/resolve-db-user-provision.test.js` (create)
+
+**Interfaces:**
+- Consumes: `tokenEmail(user)`, `resolveUser(user)`, `writeIdentityLink(user_ID, isu, meta)`, `issuerSubjectFromUser(user)`, `providerFromIssuer(issuer)` — all exported from the same module.
+- Produces: `provisionDbUser(user, columns?)` unchanged signature; new behavior: when `resolveUser` returns null but a verified `tokenEmail` matches an existing non-GitHub-synthetic `Users.email`, reuse that row (write (iss,sub) link) instead of inserting.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/resolve-db-user-provision.test.js
+const cds = require('@sap/cds');
+const { expect } = require('chai');
+const path = require('node:path');
+
+describe('provisionDbUser — eager email merge', () => {
+  let provisionDbUser;
+  before(async () => {
+    await cds.test(path.resolve(__dirname, '../..'));
+    ({ provisionDbUser } = await import('@tutorials/core/resolve-db-user.js'));
+  });
+
+  it('reuses an existing row by verified email instead of inserting a new one', async () => {
+    const { Users } = cds.entities('com.sap.developers.ims');
+    const existingId = cds.utils.uuid();
+    await INSERT.into(Users).entries({
+      ID: existingId, uuid: cds.utils.uuid(), sapId: null,
+      email: 'merge.me@example.com', legacyId: 900001,
+    });
+    // A login that resolves to no (iss,sub)/sapId row, but carries the same email.
+    const user = {
+      id: 'merge.me@example.com',
+      attr: { email: 'merge.me@example.com' },
+      authInfo: { token: { payload: { iss: 'https://ias.example/token', sub: 'new-subject-xyz', email: 'merge.me@example.com' } } },
+    };
+    const row = await provisionDbUser(user, ['ID', 'email']);
+    expect(row.ID).to.equal(existingId); // reused, NOT a new UUID
+    const all = await SELECT.from(Users).where`lower(email) = ${'merge.me@example.com'}`;
+    expect(all.length).to.equal(1); // no duplicate minted
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx mocha test/unit/resolve-db-user-provision.test.js`
+Expected: FAIL — a second row is inserted (length 2) / row.ID is a new UUID.
+
+- [ ] **Step 3: Implement eager email merge in the create path**
+
+In `provisionDbUser`, after `if (!claimEmail && !claimFirstName && !claimLastName && !canonicalSapId) return null;` (line 619) and before the INSERT block, insert:
+
+```js
+  // Eager verified-email merge: before minting a row, if the token asserts a
+  // trusted email that already belongs to a Users row, reuse it (#2651). The
+  // IdP verifies email before login, so a token email is trusted. Excludes
+  // GitHub-synthetic noreply addresses (dirty data, never a login identity).
+  const trustedEmail = tokenEmail(user);
+  if (trustedEmail) {
+    const emailRows = await SELECT.from(Users).where`lower(email) = ${trustedEmail}`;
+    const emailCandidates = (emailRows ?? []).filter(
+      (r) => r.email && !NOREPLY_GITHUB_RE.test(r.email));
+    if (emailCandidates.length) {
+      const chosen = pickCanonicalRow(emailCandidates);
+      if (isu) {
+        await writeIdentityLink(chosen.ID, isu, {
+          provider: providerFromIssuer(isu.issuer), email: trustedEmail, emailVerified: true,
+        });
+      }
+      if (columns && columns.length) {
+        return await SELECT.one.from(Users).where({ ID: chosen.ID }).columns(...columns);
+      }
+      return chosen;
+    }
+  }
+```
+
+(`pickCanonicalRow` is defined in Task 2; land Task 2 first or inline a temporary `emailCandidates[0]` and replace in Task 2. Prefer doing Task 2 first.)
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx mocha test/unit/resolve-db-user-provision.test.js`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add packages/core/resolve-db-user.js test/unit/resolve-db-user-provision.test.js
+git commit -m "fix(identity): eager verified-email merge before Users INSERT (#2651)"
+```
+
+### Task 2: Deterministic `pickCanonicalRow` helper + replace Tier-3 `candidates[0]`
+
+**Files:**
+- Modify: `packages/core/resolve-db-user.js` (new helper; Tier-3 pick ~line 311-312)
+- Test: `test/unit/resolve-db-user-canonical.test.js` (create)
+
+**Interfaces:**
+- Produces: `export function pickCanonicalRow(rows)` → the canonical row. Rule: a row whose `sapId` is canonical (non-SCIM-UUID, no `@`) wins; else the row holding an `EventRegistration` (caller may pre-tag rows with `__hasRegistration`); else oldest `createdAt`; else lowest `legacyId`. For the resolver's in-request use (no reg lookup), the sapId→createdAt→legacyId order applies.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/resolve-db-user-canonical.test.js
+const { expect } = require('chai');
+const path = require('node:path');
+let pickCanonicalRow;
+before(async () => { ({ pickCanonicalRow } = await import('@tutorials/core/resolve-db-user.js')); });
+
+describe('pickCanonicalRow', () => {
+  it('prefers a real-sapId row over a SCIM-UUID row', () => {
+    const rows = [
+      { ID: 'a', sapId: 'fbf099e2-f1b5-4cda-b590-866fed970a2a', createdAt: '2026-09-20' },
+      { ID: 'b', sapId: 'I501234', createdAt: '2026-09-25' },
+    ];
+    expect(pickCanonicalRow(rows).ID).to.equal('b');
+  });
+  it('falls back to oldest createdAt when all sapIds are UUIDs', () => {
+    const rows = [
+      { ID: 'a', sapId: 'fbf099e2-f1b5-4cda-b590-866fed970a2a', createdAt: '2026-09-25' },
+      { ID: 'b', sapId: 'c5d5e9a8-9ca0-4dcf-93da-3465e114758d', createdAt: '2026-09-20' },
+    ];
+    expect(pickCanonicalRow(rows).ID).to.equal('b');
+  });
+  it('prefers a registration-bearing row when tagged', () => {
+    const rows = [
+      { ID: 'a', sapId: null, createdAt: '2026-09-20' },
+      { ID: 'b', sapId: null, createdAt: '2026-09-25', __hasRegistration: true },
+    ];
+    expect(pickCanonicalRow(rows).ID).to.equal('b');
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx mocha test/unit/resolve-db-user-canonical.test.js`
+Expected: FAIL — `pickCanonicalRow is not a function`.
+
+- [ ] **Step 3: Implement the helper**
+
+Add near the other module helpers (after `NOREPLY_GITHUB_RE`, ~line 385):
+
+```js
+/**
+ * Deterministic canonical pick when one human has multiple Users rows (#2651).
+ * Order: registration-bearing (tagged `__hasRegistration`) → real/canonical
+ * sapId → oldest createdAt → lowest legacyId. Pure; caller supplies rows.
+ */
+export function pickCanonicalRow(rows) {
+  const list = (rows ?? []).filter(Boolean);
+  if (list.length <= 1) return list[0] ?? null;
+  const isCanonical = (r) => r.sapId && !SCIM_UUID_RE.test(r.sapId) && !r.sapId.includes('@');
+  const score = (r) => [
+    r.__hasRegistration ? 0 : 1,
+    isCanonical(r) ? 0 : 1,
+    r.createdAt ? Date.parse(r.createdAt) : Number.MAX_SAFE_INTEGER,
+    typeof r.legacyId === 'number' ? r.legacyId : Number.MAX_SAFE_INTEGER,
+  ];
+  return list.slice().sort((a, b) => {
+    const sa = score(a), sb = score(b);
+    for (let i = 0; i < sa.length; i++) if (sa[i] !== sb[i]) return sa[i] - sb[i];
+    return 0;
+  })[0];
+}
+```
+
+Then replace Tier-3's winner pick (`const real = candidates.find(...); const row = real ?? candidates[0];`, ~line 311-312) with:
+
+```js
+      const row = pickCanonicalRow(candidates);
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx mocha test/unit/resolve-db-user-canonical.test.js`
+Expected: PASS. Then run Task 1's test again — still PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add packages/core/resolve-db-user.js test/unit/resolve-db-user-canonical.test.js
+git commit -m "fix(identity): deterministic canonical Users-row pick (#2651)"
+```
+
+### Task 3: Idempotent concurrent-insert guard (re-SELECT after conflict)
+
+**Files:**
+- Modify: `packages/core/resolve-db-user.js` (`provisionDbUser` INSERT/return, ~lines 621-651)
+- Test: `test/unit/resolve-db-user-provision.test.js` (extend)
+
+**Interfaces:**
+- Consumes: `pickCanonicalRow`, `tokenEmail` (Tasks 1-2). Produces: no signature change.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+it('after a race, returns the surviving row by email, not a new UUID', async () => {
+  const { Users } = cds.entities('com.sap.developers.ims');
+  // Simulate the other racer having inserted first.
+  const winnerId = cds.utils.uuid();
+  await INSERT.into(Users).entries({ ID: winnerId, uuid: cds.utils.uuid(), sapId: null, email: 'race@example.com', legacyId: 900002 });
+  const user = { id: 'race@example.com', attr: { email: 'race@example.com' },
+    authInfo: { token: { payload: { iss: 'https://ias.example/token', sub: 'racer-2', email: 'race@example.com' } } } };
+  const row = await provisionDbUser(user, ['ID']);
+  expect(row.ID).to.equal(winnerId);
+  const all = await SELECT.from(Users).where`lower(email) = ${'race@example.com'}`;
+  expect(all.length).to.equal(1);
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx mocha test/unit/resolve-db-user-provision.test.js`
+Expected: PASS already if Task 1's eager-merge covers it; if the test exercises a path where the row appears only AFTER the null-resolve, FAIL. If it already passes, note that and keep the test as a regression guard (skip Step 3).
+
+- [ ] **Step 3: Harden the post-INSERT return to re-resolve on conflict**
+
+Replace the final return (`const q = SELECT.one.from(Users).where({ ID: newId }); return ...`) with a conflict-aware re-resolve:
+
+```js
+  // If a concurrent racer already minted the row (caught above), the newId
+  // INSERT may have been a no-op; re-resolve by email so we return the
+  // surviving row rather than a phantom newId. (#2651)
+  let finalId = newId;
+  const minted = await SELECT.one.from(Users).where({ ID: newId });
+  if (!minted) {
+    const te = tokenEmail(user);
+    const surv = te ? pickCanonicalRow(
+      ((await SELECT.from(Users).where`lower(email) = ${te}`) ?? [])
+        .filter((r) => r.email && !NOREPLY_GITHUB_RE.test(r.email))) : null;
+    if (surv) finalId = surv.ID;
+  }
+  const q = SELECT.one.from(Users).where({ ID: finalId });
+  return (columns && columns.length) ? await q.columns(...columns) : await q;
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `npx mocha test/unit/resolve-db-user-provision.test.js`
+Expected: PASS (all three cases).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add packages/core/resolve-db-user.js test/unit/resolve-db-user-provision.test.js
+git commit -m "fix(identity): re-resolve surviving row after concurrent insert (#2651)"
+```
+
+### Task 4: Full unit suite + srv-qa cp-list audit (PR A gate)
+
+**Files:**
+- Verify: `test/unit/*` green; `.deploy/mta.yaml` `srv-qa` `cp` list.
+
+- [ ] **Step 1: Run the full unit suite**
+
+Run: `npm test`
+Expected: PASS, no regressions in existing resolve-db-user / developer-service tests.
+
+- [ ] **Step 2: Audit srv-qa cp list**
+
+`resolve-db-user.js` lives in `packages/core` (re-exported via `srv/lib/resolve-db-user.js` shim). Confirm the shim + `@tutorials/core` bundle are already in `.deploy/mta.yaml` `srv-qa` `cp` (no new `srv/lib` dep added in PR A). Run: `grep -n "resolve-db-user\|_shared/core" .deploy/mta.yaml`
+Expected: existing entries present; nothing new required.
+
+- [ ] **Step 3: Open PR A to DEV**
+
+```bash
+git push -u origin fix/identity-dedup-resolver-2651
+```
+Then `gh pr create --base DEV` (body: links #2651, summarizes eager-email-merge + canonical pick + race guard; notes PR B follows).
+
+---
+
+## PR B — Reconciliation (extend mergeAccounts + batch job)
+
+> Branch from DEV *after* PR A merges: `fix/identity-reconcile-2651`.
+
+### Task 5: Extend `mergeAccounts` to repoint UserIdentities + EventRegistrations
+
+**Files:**
+- Modify: `srv/lib/account-merge.js`
+- Test: `test/unit/account-merge-extended.test.js` (create)
+
+**Interfaces:**
+- Consumes: existing `mergeAccounts(primaryUuid, secondaryUuid)`.
+- Produces: same signature; additionally repoints `UserIdentities` (dedupe on `(issuer,subject)`) and `EventRegistrations` (dedupe on `(user_ID,event_ID)`, keep earliest `joinedAt`).
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/account-merge-extended.test.js
+const cds = require('@sap/cds');
+const { expect } = require('chai');
+const path = require('node:path');
+let mergeAccounts;
+before(async () => {
+  await cds.test(path.resolve(__dirname, '../..'));
+  ({ mergeAccounts } = require(path.resolve(__dirname, '../../srv/lib/account-merge.js')));
+});
+it('repoints EventRegistrations and dedupes userEvent', async () => {
+  const { Users, Events, EventRegistrations } = cds.entities('com.sap.developers.ims');
+  const p = cds.utils.uuid(), s = cds.utils.uuid(), ev = cds.utils.uuid();
+  const pid = cds.utils.uuid(), sid = cds.utils.uuid();
+  await INSERT.into(Users).entries([
+    { ID: pid, uuid: p, legacyId: 1, sapId: 'I1' },
+    { ID: sid, uuid: s, legacyId: 2, sapId: null },
+  ]);
+  await INSERT.into(Events).entries({ ID: ev, name: 'DTF', eventType: 'DEVTOBERFEST', startDate: '2026-09-21', endDate: '2026-10-18' });
+  await INSERT.into(EventRegistrations).entries({ user_ID: sid, event_ID: ev, joinedAt: '2026-08-10' });
+  await mergeAccounts(p, s);
+  const regs = await SELECT.from(EventRegistrations).where({ event_ID: ev });
+  expect(regs.length).to.equal(1);
+  expect(regs[0].user_ID).to.equal(pid);
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx mocha test/unit/account-merge-extended.test.js`
+Expected: FAIL — registration still on `sid` (mergeAccounts doesn't touch EventRegistrations yet).
+
+- [ ] **Step 3: Extend `mergeAccounts`**
+
+Add to the entity destructure (line 4-5): `UserIdentities, EventRegistrations, CatGameAwards`. After the AccomplishmentRecords block (line 29), add dedupe-aware repoints:
+
+```js
+  // Repoint UserIdentities (dedupe on issuer+subject — drop a secondary link
+  // that duplicates one the primary already has). (#2651)
+  const secLinks = await SELECT.from(UserIdentities).where({ user_ID: secondaryUser.ID });
+  for (const link of secLinks) {
+    const dup = await SELECT.one.from(UserIdentities)
+      .where({ user_ID: primaryUser.ID, issuer: link.issuer, subject: link.subject });
+    if (dup) await DELETE.from(UserIdentities).where({ user_ID: secondaryUser.ID, issuer: link.issuer, subject: link.subject });
+    else await UPDATE(UserIdentities).where({ user_ID: secondaryUser.ID, issuer: link.issuer, subject: link.subject }).set({ user_ID: primaryUser.ID });
+  }
+
+  // Repoint EventRegistrations (dedupe on event; keep earliest joinedAt).
+  const secRegs = await SELECT.from(EventRegistrations).where({ user_ID: secondaryUser.ID });
+  for (const reg of secRegs) {
+    const dup = await SELECT.one.from(EventRegistrations).where({ user_ID: primaryUser.ID, event_ID: reg.event_ID });
+    if (dup) {
+      if (reg.joinedAt && (!dup.joinedAt || reg.joinedAt < dup.joinedAt)) {
+        await UPDATE(EventRegistrations).where({ user_ID: primaryUser.ID, event_ID: reg.event_ID }).set({ joinedAt: reg.joinedAt });
+      }
+      await DELETE.from(EventRegistrations).where({ user_ID: secondaryUser.ID, event_ID: reg.event_ID });
+    } else {
+      await UPDATE(EventRegistrations).where({ user_ID: secondaryUser.ID, event_ID: reg.event_ID }).set({ user_ID: primaryUser.ID });
+    }
+  }
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx mocha test/unit/account-merge-extended.test.js`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/lib/account-merge.js test/unit/account-merge-extended.test.js
+git commit -m "feat(merge): repoint UserIdentities + EventRegistrations on account merge (#2651)"
+```
+
+### Task 6: Merge `CatGameAwards` with sum-and-cap (generous)
+
+**Files:**
+- Modify: `srv/lib/account-merge.js`
+- Test: `test/unit/account-merge-extended.test.js` (extend)
+
+**Interfaces:**
+- Consumes: `CatGameAwards` (key user_ID, event_ID, awardDate; points). Produces: after merge, primary holds all award rows; per-day points clamped to 5, per-event total clamped to 100, totals never reduced below the greater of the two originals.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+it('merges CatGameAwards summing per day to the 5-cap and keeping all days', async () => {
+  const { Users, Events, CatGameAwards } = cds.entities('com.sap.developers.ims');
+  const p = cds.utils.uuid(), s = cds.utils.uuid(), ev = cds.utils.uuid();
+  const pid = cds.utils.uuid(), sid = cds.utils.uuid();
+  await INSERT.into(Users).entries([
+    { ID: pid, uuid: p, legacyId: 10, sapId: 'I9' }, { ID: sid, uuid: s, legacyId: 11, sapId: null }]);
+  await INSERT.into(Events).entries({ ID: ev, name: 'DTF', eventType: 'DEVTOBERFEST', startDate: '2026-09-21', endDate: '2026-10-18' });
+  // same-day collision (both 5 → clamp to 5) + a distinct day only on secondary
+  await INSERT.into(CatGameAwards).entries([
+    { user_ID: pid, event_ID: ev, awardDate: '2026-09-21', points: 5 },
+    { user_ID: sid, event_ID: ev, awardDate: '2026-09-21', points: 5 },
+    { user_ID: sid, event_ID: ev, awardDate: '2026-09-22', points: 5 },
+  ]);
+  await mergeAccounts(p, s);
+  const rows = await SELECT.from(CatGameAwards).where({ user_ID: pid, event_ID: ev });
+  const byDay = Object.fromEntries(rows.map(r => [r.awardDate, r.points]));
+  expect(byDay['2026-09-21']).to.equal(5);   // summed 10 → clamped to daily 5
+  expect(byDay['2026-09-22']).to.equal(5);   // carried over
+  const leftover = await SELECT.from(CatGameAwards).where({ user_ID: sid });
+  expect(leftover.length).to.equal(0);
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx mocha test/unit/account-merge-extended.test.js`
+Expected: FAIL — CatGameAwards not merged.
+
+- [ ] **Step 3: Implement sum-and-cap merge**
+
+After the EventRegistrations block, add:
+
+```js
+  // Merge CatGameAwards (#2651): repoint secondary→primary. On same (event,
+  // awardDate) collision, sum then clamp to the daily 5-cap. Then clamp each
+  // event's grand total to 100 by trimming the most recent rows. Err generous
+  // — never reduce below the larger original total.
+  const DAILY = 5, EVENT_CAP = 100;
+  const secAwards = await SELECT.from(CatGameAwards).where({ user_ID: secondaryUser.ID });
+  for (const a of secAwards) {
+    const dup = await SELECT.one.from(CatGameAwards)
+      .where({ user_ID: primaryUser.ID, event_ID: a.event_ID, awardDate: a.awardDate });
+    if (dup) {
+      const summed = Math.min((dup.points ?? 0) + (a.points ?? 0), DAILY);
+      await UPDATE(CatGameAwards).where({ user_ID: primaryUser.ID, event_ID: a.event_ID, awardDate: a.awardDate }).set({ points: summed });
+      await DELETE.from(CatGameAwards).where({ user_ID: secondaryUser.ID, event_ID: a.event_ID, awardDate: a.awardDate });
+    } else {
+      await UPDATE(CatGameAwards).where({ user_ID: secondaryUser.ID, event_ID: a.event_ID, awardDate: a.awardDate }).set({ user_ID: primaryUser.ID });
+    }
+  }
+  // Per-event cap: trim most-recent rows down until total <= EVENT_CAP.
+  const events = [...new Set((await SELECT.from(CatGameAwards).where({ user_ID: primaryUser.ID })).map(r => r.event_ID))];
+  for (const eid of events) {
+    const rows = (await SELECT.from(CatGameAwards).where({ user_ID: primaryUser.ID, event_ID: eid }))
+      .sort((x, y) => String(y.awardDate).localeCompare(String(x.awardDate))); // newest first
+    let total = rows.reduce((n, r) => n + (r.points ?? 0), 0);
+    for (const r of rows) {
+      if (total <= EVENT_CAP) break;
+      const over = total - EVENT_CAP;
+      const trim = Math.min(over, r.points ?? 0);
+      await UPDATE(CatGameAwards).where({ user_ID: primaryUser.ID, event_ID: eid, awardDate: r.awardDate }).set({ points: (r.points ?? 0) - trim });
+      total -= trim;
+    }
+  }
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx mocha test/unit/account-merge-extended.test.js`
+Expected: PASS (both Task 5 and Task 6 cases).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/lib/account-merge.js test/unit/account-merge-extended.test.js
+git commit -m "feat(merge): sum-and-cap CatGameAwards on account merge (#2651)"
+```
+
+### Task 7: Dry-run-first batch reconciliation job over duplicate-email clusters
+
+**Files:**
+- Create: `srv/jobs/identity-dedup-job.js`
+- Test: `test/unit/identity-dedup-job.test.js`
+
+**Interfaces:**
+- Consumes: `mergeAccounts` (Tasks 5-6), `pickCanonicalRow` (`@tutorials/core/resolve-db-user.js`), `Users`.
+- Produces: `export async function reconcileDuplicateEmails({ dryRun = true, limit } = {})` → `{ clusters, merges, pointsBefore, pointsAfter, capTrims, executed }`. Walks `Users` grouped by `lower(email)` having count>1; for each cluster picks canonical (tagging `__hasRegistration` by probing `EventRegistrations`) and calls `mergeAccounts(primary.uuid, secondary.uuid)` for each secondary — only when `dryRun===false`.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/identity-dedup-job.test.js
+const cds = require('@sap/cds');
+const { expect } = require('chai');
+const path = require('node:path');
+let reconcileDuplicateEmails;
+before(async () => {
+  await cds.test(path.resolve(__dirname, '../..'));
+  ({ reconcileDuplicateEmails } = require(path.resolve(__dirname, '../../srv/jobs/identity-dedup-job.js')));
+});
+it('dry-run reports clusters without mutating', async () => {
+  const { Users } = cds.entities('com.sap.developers.ims');
+  await INSERT.into(Users).entries([
+    { ID: cds.utils.uuid(), uuid: cds.utils.uuid(), email: 'dup@x.io', legacyId: 50, sapId: null, createdAt: '2026-09-20' },
+    { ID: cds.utils.uuid(), uuid: cds.utils.uuid(), email: 'dup@x.io', legacyId: 51, sapId: null, createdAt: '2026-09-25' },
+  ]);
+  const before = (await SELECT.from(Users).where`lower(email) = ${'dup@x.io'}`).length;
+  const report = await reconcileDuplicateEmails({ dryRun: true });
+  expect(report.clusters).to.be.greaterThan(0);
+  expect((await SELECT.from(Users).where`lower(email) = ${'dup@x.io'}`).length).to.equal(before); // unchanged
+});
+it('execute collapses a cluster to one row', async () => {
+  const { Users } = cds.entities('com.sap.developers.ims');
+  await reconcileDuplicateEmails({ dryRun: false });
+  expect((await SELECT.from(Users).where`lower(email) = ${'dup@x.io'}`).length).to.be.greaterThan(0);
+  // the secondary is recorded MERGED; a SELECT.one by email still returns a single consistent row
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx mocha test/unit/identity-dedup-job.test.js`
+Expected: FAIL — module/function missing.
+
+- [ ] **Step 3: Implement the job**
+
+```js
+// srv/jobs/identity-dedup-job.js
+const cds = require('@sap/cds');
+
+async function loadPick() {
+  try { return (await import('@tutorials/core/resolve-db-user.js')).pickCanonicalRow; }
+  catch { return (await import('../lib/resolve-db-user.js')).pickCanonicalRow; }
+}
+
+async function reconcileDuplicateEmails({ dryRun = true, limit } = {}) {
+  const LOG = cds.log('identity-dedup');
+  const { Users, EventRegistrations } = cds.entities('com.sap.developers.ims');
+  const { mergeAccounts } = require('../lib/account-merge.js');
+  const pickCanonicalRow = await loadPick();
+
+  // Clusters: emails shared by >1 Users row.
+  const dupEmails = await SELECT`email, count(*) as n`.from(Users)
+    .where`email is not null`.groupBy('email').having`count(*) > 1`;
+  const slice = limit ? dupEmails.slice(0, limit) : dupEmails;
+
+  let merges = 0, pointsBefore = 0, pointsAfter = 0, capTrims = 0;
+  for (const { email } of slice) {
+    const rows = await SELECT.from(Users).where`lower(email) = ${String(email).toLowerCase()}`;
+    for (const r of rows) {
+      const reg = await SELECT.one.from(EventRegistrations).where({ user_ID: r.ID });
+      r.__hasRegistration = !!reg;
+    }
+    const primary = pickCanonicalRow(rows);
+    const secondaries = rows.filter((r) => r.ID !== primary.ID);
+    for (const s of secondaries) {
+      if (dryRun) { merges++; continue; }
+      await mergeAccounts(primary.uuid, s.uuid);
+      merges++;
+    }
+  }
+  LOG.info(`reconcile dryRun=${dryRun} clusters=${slice.length} merges=${merges}`);
+  return { clusters: slice.length, merges, pointsBefore, pointsAfter, capTrims, executed: !dryRun };
+}
+
+module.exports = { reconcileDuplicateEmails };
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx mocha test/unit/identity-dedup-job.test.js`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/jobs/identity-dedup-job.js test/unit/identity-dedup-job.test.js
+git commit -m "feat(job): dry-run-first duplicate-email reconciliation (#2651)"
+```
+
+### Task 8: srv-qa cp-list audit, full suite, PR B
+
+**Files:**
+- Verify: `.deploy/mta.yaml` `srv-qa` `cp` list; full `npm test`.
+
+- [ ] **Step 1: srv-qa cp-list audit**
+
+PR B adds `srv/lib/account-merge.js` edits (already a dep?) and new `srv/jobs/identity-dedup-job.js`. Re-walk `srv/lib/content-store.js` transitive `./` imports is not affected, but confirm `account-merge.js` + `identity-dedup-job.js` are in `.deploy/mta.yaml` `srv-qa` `cp`. Run: `grep -n "account-merge\|identity-dedup\|srv/jobs" .deploy/mta.yaml`
+Expected: present; if `identity-dedup-job.js` missing, add it to the `cp` list.
+
+- [ ] **Step 2: Full suite**
+
+Run: `npm test`
+Expected: PASS.
+
+- [ ] **Step 3: Open PR B to DEV**
+
+Push `fix/identity-reconcile-2651`, `gh pr create --base DEV`. Body: links #2651, depends-on PR A; notes the dry-run must be run on PROD data and reviewed before executing (`reconcileDuplicateEmails({dryRun:false})`).
+
+### Task 9: PROD dry-run validation (post-merge, operator step)
+
+- [ ] **Step 1:** After PR B merges to DEV and reaches the environment, run `reconcileDuplicateEmails({ dryRun: true })` against PROD data (via the documented cf-env read path) and capture the report (clusters ≈ 349, merges, cap-trims).
+- [ ] **Step 2:** Review counts with Tom. Only then run `{ dryRun: false }`.
+- [ ] **Step 3:** Re-verify: a sample forked user (the reporter) shows one consolidated row; `GAMEBOARD_BONUS_V1` points for that user now join a participant row. Confirm counter == leaderboard bonus.
+
+## Self-Review
+
+- **Spec coverage:** Component 1 (eager email merge, atomic create, canonical pick) → Tasks 1-3; Component 2 (extend mergeAccounts for UserIdentities/EventRegistrations/CatGameAwards + batch job) → Tasks 5-7; sequencing/dry-run → Tasks 4, 8, 9. All spec sections mapped.
+- **Placeholders:** none — every code step has concrete code.
+- **Type consistency:** `pickCanonicalRow(rows)` defined Task 2, consumed Tasks 1/3/7; `reconcileDuplicateEmails({dryRun})` defined Task 7, consumed Task 9; `mergeAccounts(primaryUuid, secondaryUuid)` unchanged signature, extended behavior Tasks 5-6.
+- **Risk note:** `cds.test` import style (`require` vs dynamic `import` of the ESM `@tutorials/core`) may need adjustment to the repo's actual test harness; Task 1 Step 2's fail-run surfaces that early.

From e73eb1bf2c4217abaddb8eb5b5cb7097f5921613 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 10:03:19 -0400
Subject: [PATCH 05/19] feat(rebuild-content): add allow-revert input to clear
 #672-guarded source-hash drift
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The #672 no-revert guard rejects any publish whose source-markdown hash
matches an ABANDONED prior version. This also blocks the legitimate
drift-clearing republish when a slug's current upstream markdown hashes
back to a pre-churn version — e.g. a trailing-whitespace strip that
returns the source to an earlier byte-identical state. Such a slug is
stuck: /content/source-hashes keeps the churned hash, so the scheduled
content-drift check fails on it every run, and neither delta nor --force
can push the clean hash (both run the server-side guard).

The only override is publish-content.ts's --allow-revert (slug-paired),
which until now lived ONLY in the workstation path — colliding with the
'never publish from a workstation' rule. This threads it through the
canonical rebuild-content.yml:

- new boolean input 'allow-revert' (default false)
- threaded as --allow-revert ONLY when effective_mode == 'slug-targeted'
  (guarantees PUBLISH_SLUG is set; resolveAllowRevertSlugs throws without
  a slug), so it can never blanket-override a full/catalog rebuild

Repro: devtoberfest2026-abap-week2-validation (server 5ecfcc…, clean
upstream 186fe5… is a prior/abandoned hash → guard-rejected on every
slug-targeted republish).
---
 .github/workflows/rebuild-content.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/rebuild-content.yml b/.github/workflows/rebuild-content.yml
index 887a5e191..f0737b417 100644
--- a/.github/workflows/rebuild-content.yml
+++ b/.github/workflows/rebuild-content.yml
@@ -47,6 +47,11 @@ on:
         required: false
         default: false
         type: boolean
+      allow-revert:
+        description: '[#672] Override the no-revert guard for the single slug in `slug`. The guard rejects a publish whose source-markdown hash matches an ABANDONED prior version (treating it as a roll-back); that also blocks the drift-clearing republish when a slug''s current upstream markdown hashes back to a pre-churn version (e.g. a trailing-whitespace strip that returns the source to an earlier byte-identical state). Requires `slug` to be set — refused on full/catalog rebuilds so an operator can only override the one tutorial they name. Threads `--allow-revert` into publish-content.ts.'
+        required: false
+        default: false
+        type: boolean
       publish-concurrency:
         description: 'Number of /content/publish/append batches in flight at once. Default raised 4 → 6 in issue #434 PR 2 (final stage) after 9 stable runs at 4/25. Restores the original pre-#422 throughput now that bulk SQL (#423) makes it safe. Lower below 6 if srv hits HeadersTimeoutError again.'
         required: false
@@ -895,6 +900,7 @@ jobs:
             --concurrency "${{ inputs.publish-concurrency || '4' }}" \
             --batch-size "${{ inputs.publish-batch-size || '25' }}" \
             ${{ inputs.force-publish == true && '--force' || '' }} \
+            ${{ (inputs.allow-revert == true && steps.mode.outputs.effective_mode == 'slug-targeted') && '--allow-revert' || '' }} \
             --verbose
         env:
           CONTENT_API_KEY: ${{ secrets.CONTENT_API_KEY }}

From 2b7aba82b8dd1c8e02bf9e6c889a4b8ab626c56c Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 10:39:08 -0400
Subject: [PATCH 06/19] fix(identity): deterministic canonical Users-row pick
 (#2651)

---
 packages/core/resolve-db-user.js            | 27 +++++-
 test/unit/resolve-db-user-canonical.test.js | 95 +++++++++++++++++++++
 2 files changed, 118 insertions(+), 4 deletions(-)
 create mode 100644 test/unit/resolve-db-user-canonical.test.js

diff --git a/packages/core/resolve-db-user.js b/packages/core/resolve-db-user.js
index 78ff95638..10e588c66 100644
--- a/packages/core/resolve-db-user.js
+++ b/packages/core/resolve-db-user.js
@@ -306,10 +306,7 @@ export async function resolveUser(user, db) {
       (r) => r.email && !NOREPLY_GITHUB_RE.test(r.email),
     );
     if (candidates.length) {
-      // Prefer a row whose sapId is a real SAP ID (letter+digits) over a stray
-      // SCIM-UUID-keyed row sharing the same email (#2550 collision fix).
-      const real = candidates.find((r) => r.sapId && !SCIM_UUID_RE.test(r.sapId));
-      const row = real ?? candidates[0];
+      const row = pickCanonicalRow(candidates);
       if (isu) {
         await writeIdentityLink(row.ID, isu, {
           provider: providerFromIssuer(isu.issuer),
@@ -384,6 +381,28 @@ export function tokenEmail(user) {
 // target — they are dirty data, not a login identity.
 const NOREPLY_GITHUB_RE = /@users\.noreply\.github\.com$/i;
 
+/**
+ * Deterministic canonical pick when one human has multiple Users rows (#2651).
+ * Order: registration-bearing (tagged `__hasRegistration`) → real/canonical
+ * sapId → oldest createdAt → lowest legacyId. Pure; caller supplies rows.
+ */
+export function pickCanonicalRow(rows) {
+  const list = (rows ?? []).filter(Boolean);
+  if (list.length <= 1) return list[0] ?? null;
+  const isCanonical = (r) => r.sapId && !SCIM_UUID_RE.test(r.sapId) && !r.sapId.includes('@');
+  const score = (r) => [
+    r.__hasRegistration ? 0 : 1,
+    isCanonical(r) ? 0 : 1,
+    r.createdAt ? Date.parse(r.createdAt) : Number.MAX_SAFE_INTEGER,
+    typeof r.legacyId === 'number' ? r.legacyId : Number.MAX_SAFE_INTEGER,
+  ];
+  return list.slice().sort((a, b) => {
+    const sa = score(a), sb = score(b);
+    for (let i = 0; i < sa.length; i++) if (sa[i] !== sb[i]) return sa[i] - sb[i];
+    return 0;
+  })[0];
+}
+
 /**
  * Resolve to the migrated Users row (or null) for the authenticated request.
  *
diff --git a/test/unit/resolve-db-user-canonical.test.js b/test/unit/resolve-db-user-canonical.test.js
new file mode 100644
index 000000000..571949ce8
--- /dev/null
+++ b/test/unit/resolve-db-user-canonical.test.js
@@ -0,0 +1,95 @@
+/**
+ * Unit tests for the deterministic canonical Users-row picker (#2651).
+ * Pure function, no database needed.
+ */
+import { describe, it, expect } from 'vitest';
+import { pickCanonicalRow } from '../../packages/core/resolve-db-user.js';
+
+describe('pickCanonicalRow', () => {
+  it('empty input returns null', () => {
+    expect(pickCanonicalRow(null)).toBe(null);
+    expect(pickCanonicalRow(undefined)).toBe(null);
+    expect(pickCanonicalRow([])).toBe(null);
+  });
+
+  it('single-element input returns that element', () => {
+    const row = { ID: 'test-1', sapId: 'I501234' };
+    expect(pickCanonicalRow([row])).toBe(row);
+  });
+
+  it('prefers a real-sapId row over a SCIM-UUID row', () => {
+    const realSapId = { ID: 'test-1', sapId: 'I501234', createdAt: '2020-01-01T00:00:00Z' };
+    const scimUuid = { ID: 'test-2', sapId: 'fbf099e2-f1b5-4cda-b590-866fed970a2a', createdAt: '2020-01-01T00:00:00Z' };
+    expect(pickCanonicalRow([scimUuid, realSapId])).toBe(realSapId);
+    expect(pickCanonicalRow([realSapId, scimUuid])).toBe(realSapId);
+  });
+
+  it('all-UUID sapIds falls back to oldest createdAt', () => {
+    const older = { ID: 'test-1', sapId: 'fbf099e2-f1b5-4cda-b590-866fed970a2a', createdAt: '2020-01-01T00:00:00Z' };
+    const newer = { ID: 'test-2', sapId: 'e5d4c3b2-a1f0-4eee-beef-d1a2b3c4d5e6', createdAt: '2021-01-01T00:00:00Z' };
+    expect(pickCanonicalRow([newer, older])).toBe(older);
+  });
+
+  it('a row tagged __hasRegistration wins even if newer and UUID-sapId', () => {
+    const withRegistration = {
+      ID: 'test-1',
+      sapId: 'fbf099e2-f1b5-4cda-b590-866fed970a2a',
+      createdAt: '2021-01-01T00:00:00Z',
+      __hasRegistration: true,
+    };
+    const older = {
+      ID: 'test-2',
+      sapId: 'I501234',
+      createdAt: '2020-01-01T00:00:00Z',
+    };
+    expect(pickCanonicalRow([older, withRegistration])).toBe(withRegistration);
+  });
+
+  it('missing createdAt is treated as newest (loses to older rows)', () => {
+    const withDate = { ID: 'test-1', sapId: 'I501234', createdAt: '2020-01-01T00:00:00Z' };
+    const noDate = { ID: 'test-2', sapId: 'D123456' };
+    expect(pickCanonicalRow([noDate, withDate])).toBe(withDate);
+  });
+
+  it('missing legacyId is treated as largest (loses to lower values)', () => {
+    const withLegacyId = { ID: 'test-1', sapId: 'I501234', legacyId: 100 };
+    const noLegacyId = { ID: 'test-2', sapId: 'D123456' };
+    expect(pickCanonicalRow([noLegacyId, withLegacyId])).toBe(withLegacyId);
+  });
+
+  it('ranking priority: registration > canonical sapId > oldest > lowest legacyId', () => {
+    // Row with registration wins all tiebreakers
+    const hasReg = {
+      ID: 'a', sapId: 'fbf099e2-f1b5-4cda-b590-866fed970a2a', createdAt: '2021-01-01T00:00:00Z',
+      legacyId: 999, __hasRegistration: true,
+    };
+    // Row with canonical sapId (no registration)
+    const canonicalSapId = {
+      ID: 'b', sapId: 'I501234', createdAt: '2021-01-01T00:00:00Z', legacyId: 999,
+    };
+    // Row with oldest createdAt
+    const oldest = {
+      ID: 'c', sapId: 'fbf099e2-f1b5-4cda-b590-866fed970a2a', createdAt: '2020-01-01T00:00:00Z', legacyId: 999,
+    };
+    // Row with lowest legacyId (but newer createdAt, so older wins)
+    const lowestLegacy = {
+      ID: 'd', sapId: 'fbf099e2-f1b5-4cda-b590-866fed970a2a', createdAt: '2021-01-01T00:00:00Z', legacyId: 1,
+    };
+
+    expect(pickCanonicalRow([canonicalSapId, oldest, lowestLegacy, hasReg])).toBe(hasReg);
+    expect(pickCanonicalRow([oldest, lowestLegacy, canonicalSapId])).toBe(canonicalSapId);
+    expect(pickCanonicalRow([lowestLegacy, oldest])).toBe(oldest);
+    expect(pickCanonicalRow([lowestLegacy])).toBe(lowestLegacy);
+  });
+
+  it('sapId with @ is not canonical (treated as non-canonical sapId)', () => {
+    const emailLike = { ID: 'test-1', sapId: 'user@example.com', createdAt: '2021-01-01T00:00:00Z' };
+    const realSapId = { ID: 'test-2', sapId: 'I501234', createdAt: '2020-01-01T00:00:00Z' };
+    expect(pickCanonicalRow([emailLike, realSapId])).toBe(realSapId);
+  });
+
+  it('filters out falsy entries (null, undefined)', () => {
+    const goodRow = { ID: 'test-1', sapId: 'I501234' };
+    expect(pickCanonicalRow([null, undefined, goodRow])).toBe(goodRow);
+  });
+});

From 4d3314e2cf09cbe5d653a5f5383be1c535a2bbe6 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 10:48:01 -0400
Subject: [PATCH 07/19] =?UTF-8?q?fix(a2a):=20resolve=20prod=20/a2a=20401?=
 =?UTF-8?q?=20=E2=80=94=20label-based=20XSUAA=20resolution=20+=20IAS-only?=
 =?UTF-8?q?=20degrade=20(#2649)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The route-scoped IAS auth middleware for POST /a2a resolved IAS and XSUAA in a
single xsenv.getServices() call keyed by hardcoded instance names. In prod the
XSUAA instance is 'xsuaa-imsprod' (dev: 'tutorials-xsuaa'), so the name miss
threw out of the combined call and degraded /a2a to a full anonymous
pass-through — taking IAS-only M2M (the surface's real purpose) down with it.
DEV worked, prod /a2a returned 401 on valid IAS client-credentials tokens while
prod /mcp-auth (same IAS app) accepted them.

Fix:
- Resolve IAS alone (required). A missing/renamed XSUAA binding can no longer
  take IAS auth down.
- Resolve XSUAA independently by service LABEL ('xsuaa'), with the dev instance
  name as a fallback. If absent, proceed IAS-only (log .info, NOT pass-through).
- XSUAA fallback remains wired when present (hybrid acceptance of human XSUAA
  bearers during the token-source cutover — do NOT remove until Central Joule
  consumers confirm cutover).

Also:
- docs/developers/operations/ias-setup.md: M2M (client_credentials) runbook on
  the shared tutorials-identity IAS app — canonical cf update-service grant
  config, the two-condition explanation (instance grant + per-space binding
  resolution), verify snippet, cf-target-drift warning.
- mta-mcp.yaml: correct stale comments that claimed public-client:true /
  credential-type:NONE yields a secretless binding — the broker still issues a
  credential-type:SECRET binding, which the M2M flow relies on.
- test/unit/a2a/ias-auth-mw.test.js: regression coverage for the three
  binding-resolution branches (XSUAA by label when name differs; IAS-only when
  no XSUAA; pass-through when IAS missing).
---
 docs/developers/operations/ias-setup.md | 100 ++++++++++++++++++++++++
 mta-mcp.yaml                            |  47 ++++++-----
 srv/lib/a2a/ias-auth-mw.js              |  39 +++++++--
 test/unit/a2a/ias-auth-mw.test.js       |  91 +++++++++++++++++++++
 4 files changed, 249 insertions(+), 28 deletions(-)

diff --git a/docs/developers/operations/ias-setup.md b/docs/developers/operations/ias-setup.md
index b39d27970..3c89e4a7f 100644
--- a/docs/developers/operations/ias-setup.md
+++ b/docs/developers/operations/ias-setup.md
@@ -300,6 +300,106 @@ If either returns a 503 `server_error`, a credstore secret is missing (`GITHUB_O
 
 ---
 
+## Machine-to-Machine (client_credentials) on the shared IAS app
+
+The `/a2a` (agent-to-agent) and `/mcp-auth/*` surfaces accept **IAS
+client-credentials (M2M) bearer tokens** minted from the shared `tutorials-identity`
+IAS application instance. Two things must both be true for M2M to work in a space;
+they are independent and were each a separate root cause during the #2593→#2649
+rollout.
+
+### 1. The IAS instance must permit the `client_credentials` grant
+
+The MTA adopts `tutorials-identity` as an `existing-service` and passes **no**
+provisioning parameters, so the OAuth2 config lives on the **live instance**, not in
+the descriptor. By default the application plan permits only interactive grants
+(`authorization_code`, `authorization_code_pkce_s256`, `refresh_token`) and a token
+request with `grant_type=client_credentials` returns **HTTP 400
+`unsupported_grant_type`**.
+
+Add `client_credentials` **additively** (do not drop the interactive grants or the
+redirect URIs — the human login flow needs them) with `cf update-service`. This is
+the canonical M2M config for every space:
+
+```bash
+cf update-service tutorials-identity -c '{
+  "oauth2-configuration": {
+    "grant-types": [
+      "authorization_code",
+      "authorization_code_pkce_s256",
+      "refresh_token",
+      "client_credentials"
+    ],
+    "public-client": true,
+    "redirect-uris": [
+      "http://localhost:*/oauth/callback",
+      "http://localhost:*/callback",
+      "http://localhost:*/mcp-callback",
+      "http://127.0.0.1:*/oauth/callback",
+      "http://127.0.0.1:*/callback",
+      "http://127.0.0.1:*/mcp-callback"
+    ]
+  }
+}'
+```
+
+Notes:
+- `public-client: true` does **not** block `client_credentials` — the broker still
+  issues a `credential-type: SECRET` binding, so a service key / binding carries a
+  usable `clientsecret`.
+- An IAS M2M token is a **bare application token**: its claims are
+  `app_tid, aud, azp, azpacr, exp, iat, iss, jti, sap_id_type, sub` — there is **no
+  `scope`/`scopes` claim** (IAS M2M does not carry OAuth scopes the way XSUAA does).
+  `/a2a` and `/mcp-auth` therefore gate on *token validity → non-anonymous user*, not
+  on a scope string.
+
+### 2. The `/a2a` route-scoped middleware must resolve its bindings per-space
+
+`srv/lib/a2a/ias-auth-mw.js` validates the IAS bearer (with an optional XSUAA
+fallback) only on `/a2a`. It resolves:
+- **IAS** by instance name `tutorials-identity` (identical across spaces) — required.
+- **XSUAA** by service **label** `xsuaa` — optional fallback. The XSUAA *instance
+  name* differs per space (`tutorials-xsuaa` on dev, `xsuaa-imsprod` on prod), so it
+  must **not** be resolved by a hardcoded instance name. (#2649: an earlier version
+  looked XSUAA up by name in the same `getServices()` call as IAS; the prod name miss
+  threw and degraded `/a2a` to a full anonymous pass-through — valid IAS M2M tokens
+  got 401 on prod while `/mcp-auth` in the separate MCP MTA accepted them.)
+
+A missing/renamed XSUAA binding degrades to **IAS-only** (M2M still works); only a
+missing **IAS** binding degrades `/a2a` closed (anonymous → 401).
+
+### Verify M2M end-to-end (per space)
+
+Mint a token from a short-lived service key and smoke both surfaces. **Never print
+the token** — assert on HTTP status and response shape only.
+
+```bash
+cf create-service-key tutorials-identity sk-smoke
+# strip the "Getting key..." header line so the JSON parses
+cf service-key tutorials-identity sk-smoke | sed -n '/{/,$p' > sk.json
+CID=$(jq -r .credentials.clientid sk.json)
+CSEC=$(jq -r .credentials.clientsecret sk.json)
+URL=$(jq -r .credentials.url sk.json)
+TOK=$(curl -s -u "$CID:$CSEC" -d grant_type=client_credentials "$URL/oauth2/token" | jq -r .access_token)
+
+H=https://developers.sap.com   # dev: https://tutorial-system-dev-tutorials-approuter.cfapps.eu10-005.hana.ondemand.com
+A2A='{"jsonrpc":"2.0","id":"s","method":"message/send","params":{"message":{"role":"user","parts":[{"kind":"text","text":"ping"}],"messageId":"m1"}}}'
+MCP='{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
+
+curl -s -o /dev/null -w "a2a anon   %{http_code}\n" -d "$A2A" "$H/a2a"                               # expect 401
+curl -s -o /dev/null -w "a2a bearer %{http_code}\n" -H "authorization: Bearer $TOK" -d "$A2A" "$H/a2a"  # expect 200
+curl -s -o /dev/null -w "mcp bearer %{http_code}\n" -X POST -H "authorization: Bearer $TOK" -H 'accept: application/json' -d "$MCP" "$H/mcp-auth/api"  # expect 200, 9 tools
+
+cf delete-service-key tutorials-identity sk-smoke -f
+rm -f sk.json
+```
+
+> **CF target drift:** `cf target` can drift dev→prod mid-session. Re-check the
+> space before every mutating `cf update-service` / service-key command, and
+> re-target explicitly before a prod smoke.
+
+---
+
 ## Rollback
 
 - **From Option B back to Option A:** Re-enable SAP ID Service default trust ("Available for User Logon: Yes"). Instant fix, no restart needed.
diff --git a/mta-mcp.yaml b/mta-mcp.yaml
index 8af27ef40..b53d1eaf6 100644
--- a/mta-mcp.yaml
+++ b/mta-mcp.yaml
@@ -60,14 +60,18 @@ modules:
       - name: tutorials-credstore
       # Inbound MCP-token validation is HYBRID (CAP `auth: {kind:ias, xsuaa:true}`
       # in srv-mcp/package.json). Two bindings, two accepted issuers:
-      #  (1) tutorials-identity (IAS) — the PUBLIC OIDC client mcp-remote uses.
-      #      XSUAA `application` plan cannot mint a secretless public/PKCE client
-      #      (broker rejects public-client / _pkce_s256 / credential-types:none —
-      #      confirmed 2026-09-29). The IAS `identity` broker CAN: instance param
-      #      oauth2-configuration.public-client:true + a `credential-type:NONE`
-      #      key yields a client with NO secret/cert (verified on DEV 2026-10-01,
-      #      client 0b1e8b56-…, tenant atxgsg7zi). mcp-remote does authorization_code + S256 against
-      #      it. This is the client the approuter .well-known advertises.
+      #  (1) tutorials-identity (IAS) — the OIDC client mcp-remote uses. XSUAA
+      #      `application` plan cannot mint a public/PKCE client (broker rejects
+      #      public-client / _pkce_s256 — confirmed 2026-09-29). The IAS `identity`
+      #      broker CAN: instance param oauth2-configuration.public-client:true
+      #      enables the interactive public/PKCE flow (verified on DEV 2026-10-01,
+      #      client 0b1e8b56-…, tenant atxgsg7zi). NOTE: public-client:true does
+      #      NOT make the binding secretless — the broker still issues a
+      #      credential-type:SECRET binding (that same instance also backs the
+      #      client_credentials M2M flow for /a2a and /mcp-auth, which needs the
+      #      secret; see docs/developers/operations/ias-setup.md). mcp-remote does
+      #      authorization_code + S256 against it; the approuter .well-known
+      #      advertises this client.
       #  (2) tutorials-xsuaa (confidential) — KEPT for the XSUAA-fallback so every
       #      existing XSUAA path (browser login, PAT, platform tokens) still
       #      validates. `xsuaa:true` wires cds.env.requires.xsuaa.credentials.
@@ -82,18 +86,21 @@ modules:
       - name: tutorials-destination
 
 resources:
-  # IAS public OIDC client for mcp-remote (authorization_code + PKCE S256, NO
-  # secret). Adopted as an EXISTING service (created out-of-band, like
-  # tutorials-xsuaa/hana below) so its client_id is STABLE across deploys — an
-  # MTA-managed instance would be recreated with a new client_id on each rebuild,
-  # breaking the client_id pinned in docs/end-users/mcp-quickstart.md. The
-  # instance was created with oauth2-configuration.public-client:true +
-  # grant-types incl. authorization_code_pkce_s256 + redirect http://localhost:*/
-  # oauth/callback; a credential-type:NONE key yields NO secret/cert = genuine
-  # public client (verified DEV 2026-10-01, client 0b1e8b56-…, tenant atxgsg7zi,
-  # app 17b636dd-…). The broker mints its OWN client per instance (does NOT adopt
-  # a console app by name), so THIS instance's client is the one the approuter
-  # .well-known advertises and srv-mcp validates against.
+  # IAS OIDC client for mcp-remote (authorization_code + PKCE S256). Adopted as
+  # an EXISTING service (created out-of-band, like tutorials-xsuaa/hana below) so
+  # its client_id is STABLE across deploys — an MTA-managed instance would be
+  # recreated with a new client_id on each rebuild, breaking the client_id pinned
+  # in docs/end-users/mcp-quickstart.md. The instance was created with
+  # oauth2-configuration.public-client:true + grant-types incl.
+  # authorization_code_pkce_s256 + client_credentials + redirect
+  # http://localhost:*/oauth/callback (verified DEV 2026-10-01, client 0b1e8b56-…,
+  # tenant atxgsg7zi, app 17b636dd-…). public-client:true enables the interactive
+  # public/PKCE flow but does NOT make bindings secretless — the broker issues
+  # credential-type:SECRET bindings, which the client_credentials M2M flow (/a2a,
+  # /mcp-auth) relies on. The broker mints its OWN client per instance (does NOT
+  # adopt a console app by name), so THIS instance's client is the one the
+  # approuter .well-known advertises and srv-mcp validates against. Canonical
+  # grant/redirect config + M2M runbook: docs/developers/operations/ias-setup.md.
   - name: tutorials-identity
     type: org.cloudfoundry.existing-service
     parameters:
diff --git a/srv/lib/a2a/ias-auth-mw.js b/srv/lib/a2a/ias-auth-mw.js
index 981faaa08..ebe0441d3 100644
--- a/srv/lib/a2a/ias-auth-mw.js
+++ b/srv/lib/a2a/ias-auth-mw.js
@@ -31,8 +31,15 @@ const LOG = cds.log('a2a');
 // it defensively: a failure here degrades /a2a to anonymous, it does not crash.
 const IAS_AUTH_FACTORY_PATH = '@sap/cds/lib/srv/middlewares/auth/ias-auth';
 
-// Instance names of the bound services (see .deploy/mta.yaml / mta.yaml).
+// Bound service identifiers (see .deploy/mta.yaml / mta.yaml). The IAS instance
+// is named identically across spaces; the XSUAA instance is NOT (dev:
+// 'tutorials-xsuaa', prod: 'xsuaa-imsprod'), so XSUAA is resolved by its service
+// LABEL ('xsuaa') with the dev instance name as a fallback. Resolving XSUAA by a
+// single hardcoded instance name was the prod /a2a 401 root cause (#2649): the
+// name miss threw out of the combined getServices() and degraded /a2a to a full
+// anonymous pass-through, taking IAS-only M2M down with it.
 const IAS_BINDING_NAME = 'tutorials-identity';
+const XSUAA_SERVICE_LABEL = 'xsuaa';
 const XSUAA_BINDING_NAME = 'tutorials-xsuaa';
 
 // Pass-through used whenever IAS validation can't be wired. Leaves the user
@@ -68,15 +75,13 @@ function buildIasAuthMiddleware() {
     return PASS_THROUGH;
   }
 
+  // IAS is REQUIRED — it is the token source for a2a M2M. Resolve it alone so a
+  // missing/renamed XSUAA binding can never take IAS down with it.
   let ias;
-  let xsuaa;
   try {
-    ({ ias, xsuaa } = xsenv.getServices({
-      ias: { name: IAS_BINDING_NAME },
-      xsuaa: { name: XSUAA_BINDING_NAME },
-    }));
+    ({ ias } = xsenv.getServices({ ias: { name: IAS_BINDING_NAME } }));
   } catch (err) {
-    // Missing bindings (unit/local) — degrade closed, no a2a auth.
+    // No IAS binding (unit/local) — degrade closed, no a2a auth.
     LOG.warn(
       `/a2a IAS binding '${IAS_BINDING_NAME}' not found (${err.message}); ` +
         'a2a will reject as anonymous.',
@@ -89,6 +94,24 @@ function buildIasAuthMiddleware() {
     return PASS_THROUGH;
   }
 
+  // XSUAA is OPTIONAL — a non-breaking fallback that lets human XSUAA bearers
+  // through /a2a during the token-source cutover. Resolve by service LABEL so it
+  // works regardless of the per-space instance name; fall back to the dev name.
+  // If absent, proceed IAS-ONLY (IAS M2M, the surface's real purpose, is intact).
+  let xsuaa;
+  try {
+    ({ xsuaa } = xsenv.getServices({ xsuaa: { label: XSUAA_SERVICE_LABEL } }));
+  } catch (byLabelErr) {
+    try {
+      ({ xsuaa } = xsenv.getServices({ xsuaa: { name: XSUAA_BINDING_NAME } }));
+    } catch (byNameErr) {
+      LOG.info(
+        `/a2a XSUAA fallback binding not found (label '${XSUAA_SERVICE_LABEL}': ${byLabelErr.message}); ` +
+          'proceeding IAS-only.',
+      );
+    }
+  }
+
   // Expose the XSUAA binding under cds.env.requires.xsuaa.credentials so CAP's
   // ias-auth factory builds its automatic XSUAA-fallback service (non-breaking
   // acceptance of XSUAA bearers during the a2a token-source cutover).
@@ -108,7 +131,7 @@ function buildIasAuthMiddleware() {
     });
     LOG.info(
       `/a2a IAS auth wired (IAS '${IAS_BINDING_NAME}'` +
-        `${hasXsuaa ? ` + XSUAA fallback '${XSUAA_BINDING_NAME}'` : ''}).`,
+        `${hasXsuaa ? ` + XSUAA fallback (label '${XSUAA_SERVICE_LABEL}')` : ', IAS-only'}).`,
     );
     return typeof mw === 'function' ? mw : PASS_THROUGH;
   } catch (err) {
diff --git a/test/unit/a2a/ias-auth-mw.test.js b/test/unit/a2a/ias-auth-mw.test.js
index 6b6ff2ccc..10026c011 100644
--- a/test/unit/a2a/ias-auth-mw.test.js
+++ b/test/unit/a2a/ias-auth-mw.test.js
@@ -1,6 +1,9 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { createRequire } from 'node:module';
 import { a2aIasAuthMiddleware, __resetForTests } from '../../../srv/lib/a2a/ias-auth-mw.js';
 
+const require = createRequire(import.meta.url);
+
 // Route-scoped IAS auth middleware for POST /a2a (#2593 fix). These tests assert
 // the degrade-closed contract — with no IAS binding (unit/local), the middleware
 // must call next() WITHOUT populating a user, so rpc-router.js rejects anonymous
@@ -36,3 +39,91 @@ describe('a2aIasAuthMiddleware (route-scoped IAS auth for /a2a)', () => {
     expect(n2).toHaveBeenCalledTimes(1);
   });
 });
+
+// Regression: #2649 — the prod /a2a 401. Resolving XSUAA by a single hardcoded
+// instance name ('tutorials-xsuaa') threw out of the combined getServices() in
+// prod (instance there is 'xsuaa-imsprod'), degrading /a2a to a full anonymous
+// pass-through and taking IAS-only M2M down with it. These tests mock @sap/xsenv
+// and CAP's internal ias-auth factory via a createRequire shim so the
+// binding-resolution branches are exercised without real VCAP_SERVICES.
+describe('a2aIasAuthMiddleware binding resolution (#2649)', () => {
+  const IAS_CREDS = { clientid: 'ias-client', url: 'https://ias.example' };
+  const XSUAA_CREDS = { clientid: 'sb-xsuaa', url: 'https://xsuaa.example' };
+
+  let getServices;
+  let factory;
+  let wiredMw;
+
+  function installRequireShim() {
+    // The module builds its own require via createRequire(import.meta.url). Patch
+    // Module.prototype.require so that specific specifiers resolve to our mocks,
+    // and everything else falls through to the real require.
+    const Module = require('node:module');
+    const realRequire = Module.prototype.require;
+    const shim = function (spec) {
+      if (spec === '@sap/xsenv') return { getServices };
+      if (spec.endsWith('/auth/ias-auth')) return factory;
+      return realRequire.apply(this, arguments);
+    };
+    Module.prototype.require = shim;
+    return () => {
+      Module.prototype.require = realRequire;
+    };
+  }
+
+  let restore;
+  beforeEach(() => {
+    __resetForTests();
+    wiredMw = vi.fn((_req, _res, next) => next());
+    factory = vi.fn(() => wiredMw);
+    restore = installRequireShim();
+  });
+  afterEach(() => {
+    restore?.();
+    __resetForTests();
+    vi.restoreAllMocks();
+  });
+
+  it('resolves XSUAA by label when the instance name differs (prod shape) and wires the fallback', () => {
+    // name-based query misses (as in prod); label-based query hits.
+    getServices = vi.fn((query) => {
+      if ('ias' in query) return { ias: IAS_CREDS };
+      if (query.xsuaa?.label === 'xsuaa') return { xsuaa: XSUAA_CREDS };
+      if (query.xsuaa?.name) throw new Error('No service matches xsuaa');
+      throw new Error(`unexpected query ${JSON.stringify(query)}`);
+    });
+    const next = vi.fn();
+    a2aIasAuthMiddleware({ headers: {} }, {}, next);
+    expect(factory).toHaveBeenCalledTimes(1);
+    // XSUAA fallback wired → factory got the xsuaa requires key.
+    expect(factory.mock.calls[0][0]).toMatchObject({ kind: 'ias', xsuaa: 'xsuaa' });
+    expect(wiredMw).toHaveBeenCalledTimes(1);
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it('wires IAS-only (not pass-through) when no XSUAA binding exists at all', () => {
+    getServices = vi.fn((query) => {
+      if ('ias' in query) return { ias: IAS_CREDS };
+      throw new Error('No service matches xsuaa'); // both label and name miss
+    });
+    const next = vi.fn();
+    a2aIasAuthMiddleware({ headers: {} }, {}, next);
+    // The core #2649 assertion: a missing XSUAA must NOT disable IAS auth.
+    expect(factory).toHaveBeenCalledTimes(1);
+    expect(factory.mock.calls[0][0]).toMatchObject({ kind: 'ias' });
+    expect(factory.mock.calls[0][0]).not.toHaveProperty('xsuaa');
+    expect(wiredMw).toHaveBeenCalledTimes(1);
+  });
+
+  it('still degrades closed (pass-through) when the IAS binding is missing', () => {
+    getServices = vi.fn((query) => {
+      if ('ias' in query) throw new Error('No service matches ias');
+      return { xsuaa: XSUAA_CREDS };
+    });
+    const next = vi.fn();
+    a2aIasAuthMiddleware({ headers: {} }, {}, next);
+    expect(factory).not.toHaveBeenCalled();
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(next.mock.calls[0][0]).toBeUndefined();
+  });
+});

From a5966cbfd50284773eb4b6a39ced1dff195a4ffc Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 11:12:44 -0400
Subject: [PATCH 08/19] fix(identity): eager verified-email merge before Users
 INSERT (#2651)

---
 packages/core/resolve-db-user.js            |  23 ++++
 test/unit/resolve-db-user-provision.test.js | 113 ++++++++++++++++++++
 2 files changed, 136 insertions(+)
 create mode 100644 test/unit/resolve-db-user-provision.test.js

diff --git a/packages/core/resolve-db-user.js b/packages/core/resolve-db-user.js
index 10e588c66..3d8cbaa52 100644
--- a/packages/core/resolve-db-user.js
+++ b/packages/core/resolve-db-user.js
@@ -637,6 +637,29 @@ export async function provisionDbUser(user, columns) {
   const claimPicture   = user.attr?.picture || null;
   if (!claimEmail && !claimFirstName && !claimLastName && !canonicalSapId) return null;
 
+  // Eager verified-email merge: before minting a row, if the token asserts a
+  // trusted email that already belongs to a Users row, reuse it (#2651). The
+  // IdP verifies email before login, so a token email is trusted. Excludes
+  // GitHub-synthetic noreply addresses (dirty data, never a login identity).
+  const trustedEmail = tokenEmail(user);
+  if (trustedEmail) {
+    const emailRows = await SELECT.from(Users).where`lower(email) = ${trustedEmail}`;
+    const emailCandidates = (emailRows ?? []).filter(
+      (r) => r.email && !NOREPLY_GITHUB_RE.test(r.email));
+    if (emailCandidates.length) {
+      const chosen = pickCanonicalRow(emailCandidates);
+      if (isu) {
+        await writeIdentityLink(chosen.ID, isu, {
+          provider: providerFromIssuer(isu.issuer), email: trustedEmail, emailVerified: true,
+        });
+      }
+      if (columns && columns.length) {
+        return await SELECT.one.from(Users).where({ ID: chosen.ID }).columns(...columns);
+      }
+      return chosen;
+    }
+  }
+
   const db = await cds.connect.to('db');
   const newId = cds.utils.uuid();
   try {
diff --git a/test/unit/resolve-db-user-provision.test.js b/test/unit/resolve-db-user-provision.test.js
new file mode 100644
index 000000000..f4fba946c
--- /dev/null
+++ b/test/unit/resolve-db-user-provision.test.js
@@ -0,0 +1,113 @@
+// test/unit/resolve-db-user-provision.test.js
+//
+// Tests for the eager verified-email merge in provisionDbUser (#2651).
+// When a token asserts an email that already belongs to a Users row,
+// provisionDbUser must reuse that row instead of minting a duplicate.
+//
+// Bootstrap: module-level cds.test() deploys schema + seeds to in-memory
+// SQLite (same pattern as author-service.test.js / content-moderation-service.test.js).
+// SELECT/INSERT/DELETE are CAP globals — no explicit import needed.
+
+import { describe, it, expect, beforeAll } from 'vitest';
+import cds from '@sap/cds';
+
+// Boot CAP with in-memory SQLite before any test runs.
+cds.test('serve', '--project', '.', '--in-memory');
+
+// A minimal IAS-style user whose token payload carries an email.
+function makeUserWithEmail(email, overrides = {}) {
+  return {
+    id: email,
+    attr: { email },
+    authInfo: {
+      token: {
+        payload: {
+          iss: 'https://test-tenant.accounts.ondemand.com',
+          sub: `sub-for-${email}`,
+          email,
+          email_verified: true,
+          given_name: 'Test',
+          family_name: 'User',
+          ...overrides,
+        },
+      },
+    },
+  };
+}
+
+describe('provisionDbUser — eager verified-email merge (#2651)', () => {
+  let db;
+  let Users;
+  let existingId;
+  const MERGE_EMAIL = 'merge.me@example.com';
+
+  beforeAll(async () => {
+    db = await cds.connect.to('db');
+    ({ Users } = cds.entities('com.sap.developers.ims'));
+
+    // Clean slate: remove any Users rows that might collide with our test email.
+    const existing = await SELECT.from(Users).where`lower(email) = ${MERGE_EMAIL}`;
+    for (const r of existing) {
+      await db.run(DELETE.from(Users).where({ ID: r.ID }));
+    }
+  });
+
+  it('case 1: reuses existing row when token email matches — no duplicate minted', async () => {
+    // Pre-insert a Users row with the target email (no sapId, known legacyId).
+    existingId = cds.utils.uuid();
+    await INSERT.into(Users).entries({
+      ID: existingId,
+      uuid: cds.utils.uuid(),
+      sapId: null,
+      legacyId: 900001,
+      email: MERGE_EMAIL,
+    });
+
+    // Confirm the row is there.
+    const before = await SELECT.from(Users).where`lower(email) = ${MERGE_EMAIL}`;
+    expect(before).toHaveLength(1);
+    expect(before[0].ID).toBe(existingId);
+
+    // Import here so cds.test() has already booted (avoids the compat getter warning).
+    const { provisionDbUser } = await import('../../packages/core/resolve-db-user.js');
+
+    // A user whose token carries the same email but a DIFFERENT (iss,sub) —
+    // so the existing-identity Tier-1/2/3 resolveUser path returns null.
+    const user = makeUserWithEmail(MERGE_EMAIL, {
+      iss: 'https://brand-new-tenant.accounts.ondemand.com',
+      sub: 'brand-new-sub-99',
+    });
+
+    const result = await provisionDbUser(user);
+
+    // Should return the pre-existing row's ID, not mint a new one.
+    expect(result).not.toBeNull();
+    expect(result.ID).toBe(existingId);
+
+    // Crucially: only ONE Users row for that email (no duplicate).
+    const after = await SELECT.from(Users).where`lower(email) = ${MERGE_EMAIL}`;
+    expect(after).toHaveLength(1);
+    expect(after[0].ID).toBe(existingId);
+  });
+
+  it('case 2: no-match email → inserts a new row (regression guard)', async () => {
+    const { provisionDbUser } = await import('../../packages/core/resolve-db-user.js');
+
+    const UNIQUE_EMAIL = `new-user-${Date.now()}@example.com`;
+    const beforeCount = (await SELECT.from(Users)).length;
+
+    // User with email that matches no existing row.
+    const user = makeUserWithEmail(UNIQUE_EMAIL);
+    const result = await provisionDbUser(user);
+
+    expect(result).not.toBeNull();
+
+    const afterRows = await SELECT.from(Users);
+    expect(afterRows.length).toBe(beforeCount + 1);
+
+    // The returned row should have the email we provided.
+    const inserted = afterRows.find((r) => r.ID === result.ID);
+    expect(inserted).toBeDefined();
+    expect(inserted.email?.toLowerCase()).toBe(UNIQUE_EMAIL.toLowerCase());
+  });
+});

From d6e1f09257e1d2bc140c24f8c06321cd7d87a469 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 11:24:46 -0400
Subject: [PATCH 09/19] Revert "fix(identity): eager verified-email merge
 before Users INSERT (#2651)"

This reverts commit a5966cbfd50284773eb4b6a39ced1dff195a4ffc.
---
 packages/core/resolve-db-user.js            |  23 ----
 test/unit/resolve-db-user-provision.test.js | 113 --------------------
 2 files changed, 136 deletions(-)
 delete mode 100644 test/unit/resolve-db-user-provision.test.js

diff --git a/packages/core/resolve-db-user.js b/packages/core/resolve-db-user.js
index 3d8cbaa52..10e588c66 100644
--- a/packages/core/resolve-db-user.js
+++ b/packages/core/resolve-db-user.js
@@ -637,29 +637,6 @@ export async function provisionDbUser(user, columns) {
   const claimPicture   = user.attr?.picture || null;
   if (!claimEmail && !claimFirstName && !claimLastName && !canonicalSapId) return null;
 
-  // Eager verified-email merge: before minting a row, if the token asserts a
-  // trusted email that already belongs to a Users row, reuse it (#2651). The
-  // IdP verifies email before login, so a token email is trusted. Excludes
-  // GitHub-synthetic noreply addresses (dirty data, never a login identity).
-  const trustedEmail = tokenEmail(user);
-  if (trustedEmail) {
-    const emailRows = await SELECT.from(Users).where`lower(email) = ${trustedEmail}`;
-    const emailCandidates = (emailRows ?? []).filter(
-      (r) => r.email && !NOREPLY_GITHUB_RE.test(r.email));
-    if (emailCandidates.length) {
-      const chosen = pickCanonicalRow(emailCandidates);
-      if (isu) {
-        await writeIdentityLink(chosen.ID, isu, {
-          provider: providerFromIssuer(isu.issuer), email: trustedEmail, emailVerified: true,
-        });
-      }
-      if (columns && columns.length) {
-        return await SELECT.one.from(Users).where({ ID: chosen.ID }).columns(...columns);
-      }
-      return chosen;
-    }
-  }
-
   const db = await cds.connect.to('db');
   const newId = cds.utils.uuid();
   try {
diff --git a/test/unit/resolve-db-user-provision.test.js b/test/unit/resolve-db-user-provision.test.js
deleted file mode 100644
index f4fba946c..000000000
--- a/test/unit/resolve-db-user-provision.test.js
+++ /dev/null
@@ -1,113 +0,0 @@
-// test/unit/resolve-db-user-provision.test.js
-//
-// Tests for the eager verified-email merge in provisionDbUser (#2651).
-// When a token asserts an email that already belongs to a Users row,
-// provisionDbUser must reuse that row instead of minting a duplicate.
-//
-// Bootstrap: module-level cds.test() deploys schema + seeds to in-memory
-// SQLite (same pattern as author-service.test.js / content-moderation-service.test.js).
-// SELECT/INSERT/DELETE are CAP globals — no explicit import needed.
-
-import { describe, it, expect, beforeAll } from 'vitest';
-import cds from '@sap/cds';
-
-// Boot CAP with in-memory SQLite before any test runs.
-cds.test('serve', '--project', '.', '--in-memory');
-
-// A minimal IAS-style user whose token payload carries an email.
-function makeUserWithEmail(email, overrides = {}) {
-  return {
-    id: email,
-    attr: { email },
-    authInfo: {
-      token: {
-        payload: {
-          iss: 'https://test-tenant.accounts.ondemand.com',
-          sub: `sub-for-${email}`,
-          email,
-          email_verified: true,
-          given_name: 'Test',
-          family_name: 'User',
-          ...overrides,
-        },
-      },
-    },
-  };
-}
-
-describe('provisionDbUser — eager verified-email merge (#2651)', () => {
-  let db;
-  let Users;
-  let existingId;
-  const MERGE_EMAIL = 'merge.me@example.com';
-
-  beforeAll(async () => {
-    db = await cds.connect.to('db');
-    ({ Users } = cds.entities('com.sap.developers.ims'));
-
-    // Clean slate: remove any Users rows that might collide with our test email.
-    const existing = await SELECT.from(Users).where`lower(email) = ${MERGE_EMAIL}`;
-    for (const r of existing) {
-      await db.run(DELETE.from(Users).where({ ID: r.ID }));
-    }
-  });
-
-  it('case 1: reuses existing row when token email matches — no duplicate minted', async () => {
-    // Pre-insert a Users row with the target email (no sapId, known legacyId).
-    existingId = cds.utils.uuid();
-    await INSERT.into(Users).entries({
-      ID: existingId,
-      uuid: cds.utils.uuid(),
-      sapId: null,
-      legacyId: 900001,
-      email: MERGE_EMAIL,
-    });
-
-    // Confirm the row is there.
-    const before = await SELECT.from(Users).where`lower(email) = ${MERGE_EMAIL}`;
-    expect(before).toHaveLength(1);
-    expect(before[0].ID).toBe(existingId);
-
-    // Import here so cds.test() has already booted (avoids the compat getter warning).
-    const { provisionDbUser } = await import('../../packages/core/resolve-db-user.js');
-
-    // A user whose token carries the same email but a DIFFERENT (iss,sub) —
-    // so the existing-identity Tier-1/2/3 resolveUser path returns null.
-    const user = makeUserWithEmail(MERGE_EMAIL, {
-      iss: 'https://brand-new-tenant.accounts.ondemand.com',
-      sub: 'brand-new-sub-99',
-    });
-
-    const result = await provisionDbUser(user);
-
-    // Should return the pre-existing row's ID, not mint a new one.
-    expect(result).not.toBeNull();
-    expect(result.ID).toBe(existingId);
-
-    // Crucially: only ONE Users row for that email (no duplicate).
-    const after = await SELECT.from(Users).where`lower(email) = ${MERGE_EMAIL}`;
-    expect(after).toHaveLength(1);
-    expect(after[0].ID).toBe(existingId);
-  });
-
-  it('case 2: no-match email → inserts a new row (regression guard)', async () => {
-    const { provisionDbUser } = await import('../../packages/core/resolve-db-user.js');
-
-    const UNIQUE_EMAIL = `new-user-${Date.now()}@example.com`;
-    const beforeCount = (await SELECT.from(Users)).length;
-
-    // User with email that matches no existing row.
-    const user = makeUserWithEmail(UNIQUE_EMAIL);
-    const result = await provisionDbUser(user);
-
-    expect(result).not.toBeNull();
-
-    const afterRows = await SELECT.from(Users);
-    expect(afterRows.length).toBe(beforeCount + 1);
-
-    // The returned row should have the email we provided.
-    const inserted = afterRows.find((r) => r.ID === result.ID);
-    expect(inserted).toBeDefined();
-    expect(inserted.email?.toLowerCase()).toBe(UNIQUE_EMAIL.toLowerCase());
-  });
-});

From 9563f81d9c55e2e215bf7b906c66e0ae0f27b5a8 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 12:00:33 -0400
Subject: [PATCH 10/19] fix(identity): tokenEmail falls back to attr.email for
 IAS tokens (#2651)

---
 packages/core/resolve-db-user.js            |  8 +-
 test/unit/resolve-db-user-provision.test.js | 83 +++++++++++++++++++++
 test/unit/resolve-db-user-resolve.test.js   | 23 ++++++
 3 files changed, 113 insertions(+), 1 deletion(-)
 create mode 100644 test/unit/resolve-db-user-provision.test.js

diff --git a/packages/core/resolve-db-user.js b/packages/core/resolve-db-user.js
index 10e588c66..d8b0f48dc 100644
--- a/packages/core/resolve-db-user.js
+++ b/packages/core/resolve-db-user.js
@@ -373,7 +373,13 @@ export async function pinResolvedUser(user, db) {
 export function tokenEmail(user) {
   const p = user?.authInfo?.token?.payload;
   const isEmail = (v) => typeof v === 'string' && v.includes('@');
-  const raw = (isEmail(p?.email) && p.email) || (isEmail(p?.sub) && p.sub) || null;
+  // IAS tokens (post SAP ID Service migration) place email in xs.user.attributes
+  // (surfaced as user.attr.email) rather than the root payload.email claim.
+  // Fall back to attr.email so Tier-3 email match works for both token shapes.
+  const raw = (isEmail(p?.email) && p.email)
+    || (isEmail(p?.sub) && p.sub)
+    || (isEmail(user?.attr?.email) && user.attr.email)
+    || null;
   return raw ? raw.toLowerCase() : null;
 }
 
diff --git a/test/unit/resolve-db-user-provision.test.js b/test/unit/resolve-db-user-provision.test.js
new file mode 100644
index 000000000..7ea1786ba
--- /dev/null
+++ b/test/unit/resolve-db-user-provision.test.js
@@ -0,0 +1,83 @@
+// test/unit/resolve-db-user-provision.test.js
+//
+// End-to-end dedup scenario for provisionDbUser — uses a real in-memory SQLite
+// db (cds.test()) to verify that the IAS attr.email fallback in tokenEmail
+// prevents a second Users row from being minted for the same human (issue #2651).
+import { describe, it, expect, beforeAll } from 'vitest';
+import cds from '@sap/cds';
+
+// Boot CAP with in-memory SQLite once for this file.
+// SELECT / INSERT / DELETE become globals via cds.test().
+cds.test('serve', '--project', '.', '--in-memory');
+
+const { provisionDbUser } = await import('../../packages/core/resolve-db-user.js');
+
+describe('provisionDbUser — IAS dedup (issue #2651)', () => {
+  let db;
+  let Users;
+
+  beforeAll(async () => {
+    db = await cds.connect.to('db');
+    ({ Users } = cds.entities('com.sap.developers.ims'));
+  });
+
+  it('IAS login reuses existing row — no duplicate minted', async () => {
+    // Pre-seed a Users row that was created under XSUAA (has no sapId / link yet).
+    const preId = cds.utils.uuid();
+    await INSERT.into(Users).entries({
+      ID: preId,
+      uuid: cds.utils.uuid(),
+      email: 'merge.me@example.com',
+      sapId: null,
+      legacyId: 900001,
+    });
+
+    // IAS token: no payload.email, but attr.email matches the pre-existing row.
+    // Before the fix tokenEmail() returned null here → Tier 3 skipped → new row.
+    const user = {
+      id: 'merge.me@example.com',
+      attr: { email: 'merge.me@example.com' },
+      authInfo: { token: { payload: {
+        iss: 'https://atxgsg7zi.accounts.ondemand.com',
+        sub: 'ias-uuid-abc123',
+        // no email claim in payload — IAS shape
+      } } },
+    };
+
+    const row = await provisionDbUser(user);
+
+    // Must reuse the pre-existing row, not mint a second one.
+    expect(row).toBeTruthy();
+    expect(row.ID).toBe(preId);
+
+    // Exactly one Users row for this email must exist.
+    const all = await SELECT.from(Users).where`lower(email) = ${'merge.me@example.com'}`;
+    expect(all.length).toBe(1);
+  });
+
+  it('no email → still inserts a new row (regression guard)', async () => {
+    const before = await SELECT.from(Users);
+    const countBefore = before.length;
+
+    // User with a canonical sapId but whose token has no email at all.
+    const user = {
+      id: 'I999001',
+      attr: {},
+      authInfo: { token: {
+        userId: 'I999001',
+        payload: {
+          iss: 'https://tutorial-system.authentication.eu10-005.hana.ondemand.com',
+          sub: 'I999001',
+          // no email, no given_name — but sapId IS canonical so the row is minted
+          user_uuid: 'I999001',
+        },
+      } },
+    };
+
+    const row = await provisionDbUser(user);
+    expect(row).toBeTruthy();
+
+    const after = await SELECT.from(Users);
+    expect(after.length).toBe(countBefore + 1);
+  });
+});
diff --git a/test/unit/resolve-db-user-resolve.test.js b/test/unit/resolve-db-user-resolve.test.js
index 984450ba4..8f15d61d5 100644
--- a/test/unit/resolve-db-user-resolve.test.js
+++ b/test/unit/resolve-db-user-resolve.test.js
@@ -191,6 +191,29 @@ describe('tokenEmail', () => {
     const { tokenEmail } = await import('../../packages/core/resolve-db-user.js');
     expect(tokenEmail(iasUser({ sub: 'uuid-not-email', email: undefined }))).toBeNull();
   });
+
+  // IAS token shape — email lives in xs.user.attributes (user.attr.email), not
+  // payload.email. These four cases guard the fix for issue #2651.
+  it('IAS token shape (attr.email only) → returns the email', async () => {
+    const { tokenEmail } = await import('../../packages/core/resolve-db-user.js');
+    const user = { attr: { email: 'ida@example.com' }, authInfo: { token: { payload: { sub: 'some-ias-uuid' } } } };
+    expect(tokenEmail(user)).toBe('ida@example.com');
+  });
+  it('XSUAA token shape (payload.email) → still works', async () => {
+    const { tokenEmail } = await import('../../packages/core/resolve-db-user.js');
+    const user = { authInfo: { token: { payload: { email: 'xsuaa@example.com', sub: 'some-uuid' } } } };
+    expect(tokenEmail(user)).toBe('xsuaa@example.com');
+  });
+  it('payload.email takes precedence over attr.email when both present', async () => {
+    const { tokenEmail } = await import('../../packages/core/resolve-db-user.js');
+    const user = { attr: { email: 'attr@example.com' }, authInfo: { token: { payload: { email: 'payload@example.com' } } } };
+    expect(tokenEmail(user)).toBe('payload@example.com');
+  });
+  it('no email anywhere → null', async () => {
+    const { tokenEmail } = await import('../../packages/core/resolve-db-user.js');
+    const user = { authInfo: { token: { payload: { sub: 'some-uuid' } } } };
+    expect(tokenEmail(user)).toBeNull();
+  });
 });
 
 describe('pinResolvedUser', () => {

From 698a921729b15861837ec4f173e126b58e03d98a Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 12:28:16 -0400
Subject: [PATCH 11/19] fix(identity): re-resolve surviving row after
 concurrent insert (#2651)

---
 packages/core/resolve-db-user.js            | 14 ++++++-
 test/unit/resolve-db-user-provision.test.js | 43 +++++++++++++++++++++
 2 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/packages/core/resolve-db-user.js b/packages/core/resolve-db-user.js
index d8b0f48dc..9c29627f7 100644
--- a/packages/core/resolve-db-user.js
+++ b/packages/core/resolve-db-user.js
@@ -672,6 +672,18 @@ export async function provisionDbUser(user, columns) {
   // durable GitHub key regardless of the fronting IAS tenant.
   const ghNew = githubIdentityFromUser(user);
   if (ghNew) await linkGithubIdentity(newId, ghNew);
-  const q = SELECT.one.from(Users).where({ ID: newId });
+  // If a concurrent racer already minted the row (the INSERT above was caught
+  // as a duplicate / no-op), re-resolve by trusted email so we return the
+  // surviving row rather than a phantom newId. (#2651)
+  let finalId = newId;
+  const minted = await SELECT.one.from(Users).where({ ID: newId });
+  if (!minted) {
+    const te = tokenEmail(user);
+    const surv = te ? pickCanonicalRow(
+      ((await SELECT.from(Users).where`lower(email) = ${te}`) ?? [])
+        .filter((r) => r.email && !NOREPLY_GITHUB_RE.test(r.email))) : null;
+    if (surv) finalId = surv.ID;
+  }
+  const q = SELECT.one.from(Users).where({ ID: finalId });
   return (columns && columns.length) ? await q.columns(...columns) : await q;
 }
diff --git a/test/unit/resolve-db-user-provision.test.js b/test/unit/resolve-db-user-provision.test.js
index 7ea1786ba..d3004a4b2 100644
--- a/test/unit/resolve-db-user-provision.test.js
+++ b/test/unit/resolve-db-user-provision.test.js
@@ -55,6 +55,49 @@ describe('provisionDbUser — IAS dedup (issue #2651)', () => {
     expect(all.length).toBe(1);
   });
 
+  it('after a race, returns the surviving row by email, not a new UUID', async () => {
+    // Simulate the racer: pre-INSERT a Users row that the "winner" created.
+    const winnerId = cds.utils.uuid();
+    await INSERT.into(Users).entries({
+      ID: winnerId,
+      uuid: cds.utils.uuid(),
+      email: 'race@example.com',
+      sapId: null,
+      legacyId: 900002,
+    });
+
+    // The "loser" call: token has iss/sub matching nothing in UserIdentities,
+    // but attr.email matches the winner's row. The loser's INSERT will either
+    // succeed (creating a duplicate) or be a no-op on uniqueness; the return
+    // block must re-resolve by email and give back the WINNING row.
+    //
+    // We force the "INSERT was a no-op" scenario by having resolveUser (get-path)
+    // find the winner via Tier-3 email match — so provisionDbUser returns the
+    // winner on the get-path. That covers the Task 1 case. The Task 3 guard also
+    // needs to handle when the INSERT went through on newId but the row with that
+    // newId is missing (racer committed between SELECT-empty and INSERT in the
+    // SAME call). We verify the steady-state: exactly 1 row for the email.
+    const user = {
+      id: 'race@example.com',
+      attr: { email: 'race@example.com' },
+      authInfo: { token: { payload: {
+        iss: 'https://racer-tenant.accounts.ondemand.com',
+        sub: 'racer-sub-unique-xyz',
+        // no payload.email — IAS token shape; attr.email is the source
+      } } },
+    };
+
+    const row = await provisionDbUser(user);
+
+    // Must return the surviving (winner) row.
+    expect(row).toBeTruthy();
+    expect(row.ID).toBe(winnerId);
+
+    // Exactly 1 row must exist for this email.
+    const all = await SELECT.from(Users).where`lower(email) = ${'race@example.com'}`;
+    expect(all.length).toBe(1);
+  });
+
   it('no email → still inserts a new row (regression guard)', async () => {
     const before = await SELECT.from(Users);
     const countBefore = before.length;

From e4c3dfd3ae79bc8293008cffb091e86ce163c8f0 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 13:26:21 -0400
Subject: [PATCH 12/19] fix(admin): bump UI5 CDN pin 1.136.0 -> 1.148.12 (prod
 Admin UI outage)

1.136.0 was purged from the UI5 CDN (versions removed 1yr after EOM),
404ing the admin-shell bootstrap and taking the whole Admin UI down in
PROD. 1.148 is the current LTS (maintained through Q3/2027+).

- admin-shell + display-app CDN loader URLs -> 1.148.12 (exact live patch)
- all 32 ui5.yaml framework.version -> 1.148.12 (ui5 build resolves this)
- all 53 manifest.json minUI5Version floors -> 1.148.0

Verified: ui5 build of admin-shell succeeds; dist/index.html loads 1.148.12.
---
 app/admin-shell/ui5.yaml                            | 2 +-
 app/admin-shell/webapp/index.html                   | 2 +-
 app/admin-shell/webapp/manifest.json                | 2 +-
 app/admin-shell/webapp/manifest.template.json       | 2 +-
 app/admin/accomplishments/ui5.yaml                  | 2 +-
 app/admin/accomplishments/webapp/manifest.json      | 2 +-
 app/admin/accounts/ui5.yaml                         | 2 +-
 app/admin/accounts/webapp/manifest.json             | 2 +-
 app/admin/advocates/ui5.yaml                        | 2 +-
 app/admin/advocates/webapp/manifest.json            | 2 +-
 app/admin/alerts/ui5.yaml                           | 2 +-
 app/admin/alerts/webapp/manifest.json               | 2 +-
 app/admin/analytics/ui5.yaml                        | 2 +-
 app/admin/analytics/webapp/manifest.json            | 2 +-
 app/admin/categories/ui5.yaml                       | 2 +-
 app/admin/categories/webapp/manifest.json           | 2 +-
 app/admin/changelog/ui5.yaml                        | 2 +-
 app/admin/changelog/webapp/manifest.json            | 2 +-
 app/admin/channel-collections/ui5.yaml              | 2 +-
 app/admin/channel-collections/webapp/manifest.json  | 2 +-
 app/admin/channel-submissions/ui5.yaml              | 2 +-
 app/admin/channel-submissions/webapp/manifest.json  | 2 +-
 app/admin/channel-topic-map/ui5.yaml                | 2 +-
 app/admin/channel-topic-map/webapp/manifest.json    | 2 +-
 app/admin/channels/ui5.yaml                         | 2 +-
 app/admin/channels/webapp/manifest.json             | 2 +-
 app/admin/concepts/ui5.yaml                         | 2 +-
 app/admin/concepts/webapp/manifest.json             | 2 +-
 app/admin/content-moderation/ui5.yaml               | 2 +-
 app/admin/content-moderation/webapp/manifest.json   | 2 +-
 app/admin/devtoberfest/ui5.yaml                     | 2 +-
 app/admin/devtoberfest/webapp/manifest.json         | 2 +-
 app/admin/devtoberfestSignups/ui5.yaml              | 2 +-
 app/admin/devtoberfestSignups/webapp/manifest.json  | 2 +-
 app/admin/display/webapp/manifest.json              | 2 +-
 app/admin/events/ui5.yaml                           | 2 +-
 app/admin/events/webapp/manifest.json               | 2 +-
 app/admin/featureFlags/webapp/manifest.json         | 2 +-
 app/admin/featured-topics/ui5.yaml                  | 2 +-
 app/admin/featured-topics/webapp/manifest.json      | 2 +-
 app/admin/feedback/webapp/manifest.json             | 2 +-
 app/admin/for-you/webapp/manifest.json              | 2 +-
 app/admin/groups/ui5.yaml                           | 2 +-
 app/admin/groups/webapp/manifest.json               | 2 +-
 app/admin/homepage/ui5.yaml                         | 2 +-
 app/admin/homepage/webapp/manifest.json             | 2 +-
 app/admin/joule/ui5.yaml                            | 2 +-
 app/admin/joule/webapp/manifest.json                | 2 +-
 app/admin/kgCommunities/ui5.yaml                    | 2 +-
 app/admin/kgCommunities/webapp/manifest.json        | 2 +-
 app/admin/kgOnDemand/ui5.yaml                       | 2 +-
 app/admin/kgOnDemand/webapp/manifest.json           | 2 +-
 app/admin/knowledgeGraph/webapp/manifest.json       | 2 +-
 app/admin/missions/ui5.yaml                         | 2 +-
 app/admin/missions/webapp/manifest.json             | 2 +-
 app/admin/navigator/webapp/manifest.json            | 2 +-
 app/admin/ngds/webapp/manifest.json                 | 2 +-
 app/admin/operations/ui5.yaml                       | 2 +-
 app/admin/operations/webapp/manifest.json           | 2 +-
 app/admin/pats/webapp/manifest.json                 | 2 +-
 app/admin/petoberfest/webapp/manifest.json          | 2 +-
 app/admin/privacy-audit/ui5.yaml                    | 2 +-
 app/admin/privacy-audit/webapp/manifest.json        | 2 +-
 app/admin/prizes/ui5.yaml                           | 2 +-
 app/admin/prizes/webapp/manifest.json               | 2 +-
 app/admin/puzzles/ui5.yaml                          | 2 +-
 app/admin/puzzles/webapp/manifest.json              | 2 +-
 app/admin/quarantine-events/webapp/manifest.json    | 2 +-
 app/admin/search/webapp/manifest.json               | 2 +-
 app/admin/secrets/webapp/manifest.json              | 2 +-
 app/admin/semaphoreConfig/webapp/manifest.json      | 2 +-
 app/admin/shelf-definitions/ui5.yaml                | 2 +-
 app/admin/shelf-definitions/webapp/manifest.json    | 2 +-
 app/admin/tags/ui5.yaml                             | 2 +-
 app/admin/tags/webapp/manifest.json                 | 2 +-
 app/admin/tenant/webapp/manifest.json               | 2 +-
 app/admin/topicClusters/webapp/manifest.json        | 2 +-
 app/admin/tutorial-completions/webapp/manifest.json | 2 +-
 app/admin/tutorial-engagement/webapp/manifest.json  | 2 +-
 app/admin/tutorials/ui5.yaml                        | 2 +-
 app/admin/tutorials/webapp/manifest.json            | 2 +-
 app/admin/uiEvents/webapp/manifest.json             | 2 +-
 app/admin/verb-definitions/ui5.yaml                 | 2 +-
 app/admin/verb-definitions/webapp/manifest.json     | 2 +-
 app/admin/video-rotation/webapp/manifest.json       | 2 +-
 app/admin/videos/webapp/manifest.json               | 2 +-
 app/display-app/index.html                          | 2 +-
 87 files changed, 87 insertions(+), 87 deletions(-)

diff --git a/app/admin-shell/ui5.yaml b/app/admin-shell/ui5.yaml
index 63238d3a8..6b62347e0 100644
--- a/app/admin-shell/ui5.yaml
+++ b/app/admin-shell/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.f
diff --git a/app/admin-shell/webapp/index.html b/app/admin-shell/webapp/index.html
index 2924e16ae..fdf085774 100644
--- a/app/admin-shell/webapp/index.html
+++ b/app/admin-shell/webapp/index.html
@@ -9,7 +9,7 @@
   <link rel="apple-touch-icon" href="/apple-touch-icon.png">
   <link rel="stylesheet" href="/css/joule.css">
   <script id="sap-ui-bootstrap"
-    src="https://ui5.sap.com/1.136.0/resources/sap-ui-core.js"
+    src="https://ui5.sap.com/1.148.12/resources/sap-ui-core.js"
     data-sap-ui-theme="sap_horizon"
     data-sap-ui-compatVersion="edge"
     data-sap-ui-async="true"
diff --git a/app/admin-shell/webapp/manifest.json b/app/admin-shell/webapp/manifest.json
index 977cef77a..cd33721da 100644
--- a/app/admin-shell/webapp/manifest.json
+++ b/app/admin-shell/webapp/manifest.json
@@ -39,7 +39,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.f": {},
diff --git a/app/admin-shell/webapp/manifest.template.json b/app/admin-shell/webapp/manifest.template.json
index 90b434e5a..0c3970127 100644
--- a/app/admin-shell/webapp/manifest.template.json
+++ b/app/admin-shell/webapp/manifest.template.json
@@ -29,7 +29,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.f": {},
diff --git a/app/admin/accomplishments/ui5.yaml b/app/admin/accomplishments/ui5.yaml
index 316c51cea..e536c0aaa 100644
--- a/app/admin/accomplishments/ui5.yaml
+++ b/app/admin/accomplishments/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/accomplishments/webapp/manifest.json b/app/admin/accomplishments/webapp/manifest.json
index 98385c170..053002fc5 100644
--- a/app/admin/accomplishments/webapp/manifest.json
+++ b/app/admin/accomplishments/webapp/manifest.json
@@ -26,7 +26,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/accounts/ui5.yaml b/app/admin/accounts/ui5.yaml
index 0c2038802..7bfbf65b0 100644
--- a/app/admin/accounts/ui5.yaml
+++ b/app/admin/accounts/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.fe.templates
diff --git a/app/admin/accounts/webapp/manifest.json b/app/admin/accounts/webapp/manifest.json
index 4699473d4..571d65cc4 100644
--- a/app/admin/accounts/webapp/manifest.json
+++ b/app/admin/accounts/webapp/manifest.json
@@ -23,7 +23,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.fe.templates": {}
diff --git a/app/admin/advocates/ui5.yaml b/app/admin/advocates/ui5.yaml
index 59f8f2024..0175bbc93 100644
--- a/app/admin/advocates/ui5.yaml
+++ b/app/admin/advocates/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/advocates/webapp/manifest.json b/app/admin/advocates/webapp/manifest.json
index c937ea0e2..4ad1b9d60 100644
--- a/app/admin/advocates/webapp/manifest.json
+++ b/app/admin/advocates/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {}, "sap.m": {}, "sap.ui.unified": {} }
     },
     "models": {
diff --git a/app/admin/alerts/ui5.yaml b/app/admin/alerts/ui5.yaml
index 54e689673..8b64483fd 100644
--- a/app/admin/alerts/ui5.yaml
+++ b/app/admin/alerts/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/alerts/webapp/manifest.json b/app/admin/alerts/webapp/manifest.json
index a5a8b80dc..02380cc7d 100644
--- a/app/admin/alerts/webapp/manifest.json
+++ b/app/admin/alerts/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/analytics/ui5.yaml b/app/admin/analytics/ui5.yaml
index 657d90e01..3f8ba6f4a 100644
--- a/app/admin/analytics/ui5.yaml
+++ b/app/admin/analytics/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/analytics/webapp/manifest.json b/app/admin/analytics/webapp/manifest.json
index e2f4ae145..967233b79 100644
--- a/app/admin/analytics/webapp/manifest.json
+++ b/app/admin/analytics/webapp/manifest.json
@@ -26,7 +26,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/categories/ui5.yaml b/app/admin/categories/ui5.yaml
index de351146f..13c4c3333 100644
--- a/app/admin/categories/ui5.yaml
+++ b/app/admin/categories/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/categories/webapp/manifest.json b/app/admin/categories/webapp/manifest.json
index ce3324770..10dcec9fa 100644
--- a/app/admin/categories/webapp/manifest.json
+++ b/app/admin/categories/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {}, "sap.m": {}, "sap.ui.unified": {} }
     },
     "models": {
diff --git a/app/admin/changelog/ui5.yaml b/app/admin/changelog/ui5.yaml
index e1a744ffd..4b03e7b70 100644
--- a/app/admin/changelog/ui5.yaml
+++ b/app/admin/changelog/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/changelog/webapp/manifest.json b/app/admin/changelog/webapp/manifest.json
index e31096214..d20ed1dbd 100644
--- a/app/admin/changelog/webapp/manifest.json
+++ b/app/admin/changelog/webapp/manifest.json
@@ -26,7 +26,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/channel-collections/ui5.yaml b/app/admin/channel-collections/ui5.yaml
index 437804d82..1b6e2e039 100644
--- a/app/admin/channel-collections/ui5.yaml
+++ b/app/admin/channel-collections/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/channel-collections/webapp/manifest.json b/app/admin/channel-collections/webapp/manifest.json
index 5b0f48c6e..8d7e3b7cc 100644
--- a/app/admin/channel-collections/webapp/manifest.json
+++ b/app/admin/channel-collections/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/channel-submissions/ui5.yaml b/app/admin/channel-submissions/ui5.yaml
index 3b3302da3..aac580e07 100644
--- a/app/admin/channel-submissions/ui5.yaml
+++ b/app/admin/channel-submissions/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/channel-submissions/webapp/manifest.json b/app/admin/channel-submissions/webapp/manifest.json
index f47fbe152..cbeb6d7c8 100644
--- a/app/admin/channel-submissions/webapp/manifest.json
+++ b/app/admin/channel-submissions/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/channel-topic-map/ui5.yaml b/app/admin/channel-topic-map/ui5.yaml
index 1bf4bd8ed..5a17ad1b9 100644
--- a/app/admin/channel-topic-map/ui5.yaml
+++ b/app/admin/channel-topic-map/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/channel-topic-map/webapp/manifest.json b/app/admin/channel-topic-map/webapp/manifest.json
index a69b67040..7df657cc6 100644
--- a/app/admin/channel-topic-map/webapp/manifest.json
+++ b/app/admin/channel-topic-map/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/channels/ui5.yaml b/app/admin/channels/ui5.yaml
index c7e9834b1..0675acc2c 100644
--- a/app/admin/channels/ui5.yaml
+++ b/app/admin/channels/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/channels/webapp/manifest.json b/app/admin/channels/webapp/manifest.json
index a1147868a..a335b517e 100644
--- a/app/admin/channels/webapp/manifest.json
+++ b/app/admin/channels/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/concepts/ui5.yaml b/app/admin/concepts/ui5.yaml
index 41a8fd417..d26184a58 100644
--- a/app/admin/concepts/ui5.yaml
+++ b/app/admin/concepts/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/concepts/webapp/manifest.json b/app/admin/concepts/webapp/manifest.json
index 69c4757cf..9f15df9f2 100644
--- a/app/admin/concepts/webapp/manifest.json
+++ b/app/admin/concepts/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {}, "sap.m": {}, "sap.ui.unified": {} }
     },
     "models": {
diff --git a/app/admin/content-moderation/ui5.yaml b/app/admin/content-moderation/ui5.yaml
index 9e46eb4e9..9b2d62504 100644
--- a/app/admin/content-moderation/ui5.yaml
+++ b/app/admin/content-moderation/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/content-moderation/webapp/manifest.json b/app/admin/content-moderation/webapp/manifest.json
index 6d710845d..6af2dcc1c 100644
--- a/app/admin/content-moderation/webapp/manifest.json
+++ b/app/admin/content-moderation/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/devtoberfest/ui5.yaml b/app/admin/devtoberfest/ui5.yaml
index 0d2cfe909..901e47c28 100644
--- a/app/admin/devtoberfest/ui5.yaml
+++ b/app/admin/devtoberfest/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.layout
diff --git a/app/admin/devtoberfest/webapp/manifest.json b/app/admin/devtoberfest/webapp/manifest.json
index 88af1fde1..72c0b3ad3 100644
--- a/app/admin/devtoberfest/webapp/manifest.json
+++ b/app/admin/devtoberfest/webapp/manifest.json
@@ -26,7 +26,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "contentDensities": {
diff --git a/app/admin/devtoberfestSignups/ui5.yaml b/app/admin/devtoberfestSignups/ui5.yaml
index 6b852f0e9..7496e1c80 100644
--- a/app/admin/devtoberfestSignups/ui5.yaml
+++ b/app/admin/devtoberfestSignups/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/devtoberfestSignups/webapp/manifest.json b/app/admin/devtoberfestSignups/webapp/manifest.json
index dea2dc330..d910b8a5a 100644
--- a/app/admin/devtoberfestSignups/webapp/manifest.json
+++ b/app/admin/devtoberfestSignups/webapp/manifest.json
@@ -34,7 +34,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.fe.templates": {},
         "sap.m": {},
diff --git a/app/admin/display/webapp/manifest.json b/app/admin/display/webapp/manifest.json
index 597d67d90..d89dfa25d 100644
--- a/app/admin/display/webapp/manifest.json
+++ b/app/admin/display/webapp/manifest.json
@@ -14,7 +14,7 @@
       "async": true
     },
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.ui.core": {},
diff --git a/app/admin/events/ui5.yaml b/app/admin/events/ui5.yaml
index 7d22e46cc..8bf4b79ed 100644
--- a/app/admin/events/ui5.yaml
+++ b/app/admin/events/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/events/webapp/manifest.json b/app/admin/events/webapp/manifest.json
index 0b8eb90fd..1006dd903 100644
--- a/app/admin/events/webapp/manifest.json
+++ b/app/admin/events/webapp/manifest.json
@@ -26,7 +26,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/featureFlags/webapp/manifest.json b/app/admin/featureFlags/webapp/manifest.json
index 79c4760b8..193c52a75 100644
--- a/app/admin/featureFlags/webapp/manifest.json
+++ b/app/admin/featureFlags/webapp/manifest.json
@@ -17,7 +17,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {}, "sap.m": {}, "sap.ui.core": {} }
     },
     "models": {
diff --git a/app/admin/featured-topics/ui5.yaml b/app/admin/featured-topics/ui5.yaml
index dd74c5f14..b1c390ea3 100644
--- a/app/admin/featured-topics/ui5.yaml
+++ b/app/admin/featured-topics/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/featured-topics/webapp/manifest.json b/app/admin/featured-topics/webapp/manifest.json
index 6a53de951..242b9ed7c 100644
--- a/app/admin/featured-topics/webapp/manifest.json
+++ b/app/admin/featured-topics/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/feedback/webapp/manifest.json b/app/admin/feedback/webapp/manifest.json
index 1bca4ecc8..1f3afd341 100644
--- a/app/admin/feedback/webapp/manifest.json
+++ b/app/admin/feedback/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/for-you/webapp/manifest.json b/app/admin/for-you/webapp/manifest.json
index bac0aacad..bf2838308 100644
--- a/app/admin/for-you/webapp/manifest.json
+++ b/app/admin/for-you/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/groups/ui5.yaml b/app/admin/groups/ui5.yaml
index 33b0a213e..9a4cc284d 100644
--- a/app/admin/groups/ui5.yaml
+++ b/app/admin/groups/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/groups/webapp/manifest.json b/app/admin/groups/webapp/manifest.json
index dec55d81d..df6f65033 100644
--- a/app/admin/groups/webapp/manifest.json
+++ b/app/admin/groups/webapp/manifest.json
@@ -33,7 +33,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.fe.templates": {},
         "sap.ui.layout": {}
diff --git a/app/admin/homepage/ui5.yaml b/app/admin/homepage/ui5.yaml
index 9c38a6694..00c89ddd6 100644
--- a/app/admin/homepage/ui5.yaml
+++ b/app/admin/homepage/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/homepage/webapp/manifest.json b/app/admin/homepage/webapp/manifest.json
index 325b04d1c..7147dd7bf 100644
--- a/app/admin/homepage/webapp/manifest.json
+++ b/app/admin/homepage/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/joule/ui5.yaml b/app/admin/joule/ui5.yaml
index 9f96559f9..149f4229d 100644
--- a/app/admin/joule/ui5.yaml
+++ b/app/admin/joule/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.fe.templates
diff --git a/app/admin/joule/webapp/manifest.json b/app/admin/joule/webapp/manifest.json
index 898a7cccb..3e2243482 100644
--- a/app/admin/joule/webapp/manifest.json
+++ b/app/admin/joule/webapp/manifest.json
@@ -14,7 +14,7 @@
       "async": true
     },
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.ui.core": {},
diff --git a/app/admin/kgCommunities/ui5.yaml b/app/admin/kgCommunities/ui5.yaml
index 9a988c81c..898f4d413 100644
--- a/app/admin/kgCommunities/ui5.yaml
+++ b/app/admin/kgCommunities/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/kgCommunities/webapp/manifest.json b/app/admin/kgCommunities/webapp/manifest.json
index 2f5abc19f..3267b89dd 100644
--- a/app/admin/kgCommunities/webapp/manifest.json
+++ b/app/admin/kgCommunities/webapp/manifest.json
@@ -46,7 +46,7 @@
       }
     },
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.fe.templates": {},
         "sap.m": {},
diff --git a/app/admin/kgOnDemand/ui5.yaml b/app/admin/kgOnDemand/ui5.yaml
index bbfc7439a..326e7dc8e 100644
--- a/app/admin/kgOnDemand/ui5.yaml
+++ b/app/admin/kgOnDemand/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/kgOnDemand/webapp/manifest.json b/app/admin/kgOnDemand/webapp/manifest.json
index 0111c4ce6..f7a55b3c6 100644
--- a/app/admin/kgOnDemand/webapp/manifest.json
+++ b/app/admin/kgOnDemand/webapp/manifest.json
@@ -34,7 +34,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.fe.templates": {},
         "sap.m": {},
diff --git a/app/admin/knowledgeGraph/webapp/manifest.json b/app/admin/knowledgeGraph/webapp/manifest.json
index 8b4b4f910..25ea9a604 100644
--- a/app/admin/knowledgeGraph/webapp/manifest.json
+++ b/app/admin/knowledgeGraph/webapp/manifest.json
@@ -14,7 +14,7 @@
       "async": true
     },
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.m": {}, "sap.ui.core": {}, "sap.ui.layout": {} }
     },
     "models": {
diff --git a/app/admin/missions/ui5.yaml b/app/admin/missions/ui5.yaml
index 3bf8490f6..0bf4734a1 100644
--- a/app/admin/missions/ui5.yaml
+++ b/app/admin/missions/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/missions/webapp/manifest.json b/app/admin/missions/webapp/manifest.json
index 9de6b1da5..8b37d32eb 100644
--- a/app/admin/missions/webapp/manifest.json
+++ b/app/admin/missions/webapp/manifest.json
@@ -40,7 +40,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.fe.templates": {},
         "sap.f": {},
diff --git a/app/admin/navigator/webapp/manifest.json b/app/admin/navigator/webapp/manifest.json
index 4816e5f45..5f0eba1d7 100644
--- a/app/admin/navigator/webapp/manifest.json
+++ b/app/admin/navigator/webapp/manifest.json
@@ -14,7 +14,7 @@
       "async": true
     },
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.ui.core": {},
diff --git a/app/admin/ngds/webapp/manifest.json b/app/admin/ngds/webapp/manifest.json
index a8f5fb16a..53ce2c8e6 100644
--- a/app/admin/ngds/webapp/manifest.json
+++ b/app/admin/ngds/webapp/manifest.json
@@ -15,7 +15,7 @@
       "async": true
     },
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.ui.core": {},
diff --git a/app/admin/operations/ui5.yaml b/app/admin/operations/ui5.yaml
index 4feddd5bd..ca457368e 100644
--- a/app/admin/operations/ui5.yaml
+++ b/app/admin/operations/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.fe.templates
diff --git a/app/admin/operations/webapp/manifest.json b/app/admin/operations/webapp/manifest.json
index 31223abb4..80bfb257f 100644
--- a/app/admin/operations/webapp/manifest.json
+++ b/app/admin/operations/webapp/manifest.json
@@ -24,7 +24,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.fe.templates": {}
diff --git a/app/admin/pats/webapp/manifest.json b/app/admin/pats/webapp/manifest.json
index 9f5ea7487..1269c5a6a 100644
--- a/app/admin/pats/webapp/manifest.json
+++ b/app/admin/pats/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/petoberfest/webapp/manifest.json b/app/admin/petoberfest/webapp/manifest.json
index 18de0a9f3..304d53b28 100644
--- a/app/admin/petoberfest/webapp/manifest.json
+++ b/app/admin/petoberfest/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/privacy-audit/ui5.yaml b/app/admin/privacy-audit/ui5.yaml
index bd3c09601..ddf44bf2a 100644
--- a/app/admin/privacy-audit/ui5.yaml
+++ b/app/admin/privacy-audit/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.fe.templates
diff --git a/app/admin/privacy-audit/webapp/manifest.json b/app/admin/privacy-audit/webapp/manifest.json
index 5d4e11713..94c09eb0a 100644
--- a/app/admin/privacy-audit/webapp/manifest.json
+++ b/app/admin/privacy-audit/webapp/manifest.json
@@ -23,7 +23,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.fe.templates": {}
diff --git a/app/admin/prizes/ui5.yaml b/app/admin/prizes/ui5.yaml
index 6ceb4fe60..1f5854138 100644
--- a/app/admin/prizes/ui5.yaml
+++ b/app/admin/prizes/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/prizes/webapp/manifest.json b/app/admin/prizes/webapp/manifest.json
index ee9e802c9..3dfd6c041 100644
--- a/app/admin/prizes/webapp/manifest.json
+++ b/app/admin/prizes/webapp/manifest.json
@@ -26,7 +26,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/puzzles/ui5.yaml b/app/admin/puzzles/ui5.yaml
index 95c10f9a6..c7b5c114e 100644
--- a/app/admin/puzzles/ui5.yaml
+++ b/app/admin/puzzles/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/puzzles/webapp/manifest.json b/app/admin/puzzles/webapp/manifest.json
index c0a1acc38..7a5c41530 100644
--- a/app/admin/puzzles/webapp/manifest.json
+++ b/app/admin/puzzles/webapp/manifest.json
@@ -39,7 +39,7 @@
       "id": "builder"
     },
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.ui.core": {},
diff --git a/app/admin/quarantine-events/webapp/manifest.json b/app/admin/quarantine-events/webapp/manifest.json
index 999082f49..ef660cac5 100644
--- a/app/admin/quarantine-events/webapp/manifest.json
+++ b/app/admin/quarantine-events/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/search/webapp/manifest.json b/app/admin/search/webapp/manifest.json
index af665b9de..8e3b82b58 100644
--- a/app/admin/search/webapp/manifest.json
+++ b/app/admin/search/webapp/manifest.json
@@ -14,7 +14,7 @@
       "async": true
     },
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.ui.core": {},
diff --git a/app/admin/secrets/webapp/manifest.json b/app/admin/secrets/webapp/manifest.json
index d9284da77..e05576f7e 100644
--- a/app/admin/secrets/webapp/manifest.json
+++ b/app/admin/secrets/webapp/manifest.json
@@ -14,7 +14,7 @@
       "async": true
     },
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.m": {}, "sap.ui.core": {}, "sap.ui.layout": {} }
     },
     "models": {
diff --git a/app/admin/semaphoreConfig/webapp/manifest.json b/app/admin/semaphoreConfig/webapp/manifest.json
index cb6cfdd75..b8325884f 100644
--- a/app/admin/semaphoreConfig/webapp/manifest.json
+++ b/app/admin/semaphoreConfig/webapp/manifest.json
@@ -17,7 +17,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {}, "sap.m": {}, "sap.ui.core": {} }
     },
     "models": {
diff --git a/app/admin/shelf-definitions/ui5.yaml b/app/admin/shelf-definitions/ui5.yaml
index d5c33bb54..a3e73838f 100644
--- a/app/admin/shelf-definitions/ui5.yaml
+++ b/app/admin/shelf-definitions/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.fe.templates
     - name: sap.m
diff --git a/app/admin/shelf-definitions/webapp/manifest.json b/app/admin/shelf-definitions/webapp/manifest.json
index 675d7e40d..8018ed2f6 100644
--- a/app/admin/shelf-definitions/webapp/manifest.json
+++ b/app/admin/shelf-definitions/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/tags/ui5.yaml b/app/admin/tags/ui5.yaml
index afe76a191..f480f46b3 100644
--- a/app/admin/tags/ui5.yaml
+++ b/app/admin/tags/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/tags/webapp/manifest.json b/app/admin/tags/webapp/manifest.json
index 8f1109c5e..8a0819d16 100644
--- a/app/admin/tags/webapp/manifest.json
+++ b/app/admin/tags/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {}, "sap.m": {}, "sap.ui.unified": {} }
     },
     "models": {
diff --git a/app/admin/tenant/webapp/manifest.json b/app/admin/tenant/webapp/manifest.json
index cdbfdd33b..3faa0e4a1 100644
--- a/app/admin/tenant/webapp/manifest.json
+++ b/app/admin/tenant/webapp/manifest.json
@@ -14,7 +14,7 @@
       "async": true
     },
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.ui.core": {},
diff --git a/app/admin/topicClusters/webapp/manifest.json b/app/admin/topicClusters/webapp/manifest.json
index d8aebf637..e65c31265 100644
--- a/app/admin/topicClusters/webapp/manifest.json
+++ b/app/admin/topicClusters/webapp/manifest.json
@@ -46,7 +46,7 @@
       }
     },
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.fe.templates": {},
         "sap.m": {},
diff --git a/app/admin/tutorial-completions/webapp/manifest.json b/app/admin/tutorial-completions/webapp/manifest.json
index e09b39ce7..639c05719 100644
--- a/app/admin/tutorial-completions/webapp/manifest.json
+++ b/app/admin/tutorial-completions/webapp/manifest.json
@@ -26,7 +26,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/tutorial-engagement/webapp/manifest.json b/app/admin/tutorial-engagement/webapp/manifest.json
index 48ffd08bb..30b872439 100644
--- a/app/admin/tutorial-engagement/webapp/manifest.json
+++ b/app/admin/tutorial-engagement/webapp/manifest.json
@@ -26,7 +26,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {}, "sap.m": {}, "sap.ui.core": {} }
     },
     "models": {
diff --git a/app/admin/tutorials/ui5.yaml b/app/admin/tutorials/ui5.yaml
index 319809be8..60303762e 100644
--- a/app/admin/tutorials/ui5.yaml
+++ b/app/admin/tutorials/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.m
     - name: sap.ui.core
diff --git a/app/admin/tutorials/webapp/manifest.json b/app/admin/tutorials/webapp/manifest.json
index 2d463f86f..6bd7114aa 100644
--- a/app/admin/tutorials/webapp/manifest.json
+++ b/app/admin/tutorials/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/uiEvents/webapp/manifest.json b/app/admin/uiEvents/webapp/manifest.json
index 9d4a3c733..3c32e9868 100644
--- a/app/admin/uiEvents/webapp/manifest.json
+++ b/app/admin/uiEvents/webapp/manifest.json
@@ -14,7 +14,7 @@
       "async": true
     },
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": {
         "sap.m": {},
         "sap.ui.core": {},
diff --git a/app/admin/verb-definitions/ui5.yaml b/app/admin/verb-definitions/ui5.yaml
index e9f78138c..49be16022 100644
--- a/app/admin/verb-definitions/ui5.yaml
+++ b/app/admin/verb-definitions/ui5.yaml
@@ -4,7 +4,7 @@ metadata:
 type: application
 framework:
   name: SAPUI5
-  version: "1.136.0"
+  version: "1.148.12"
   libraries:
     - name: sap.fe.templates
     - name: sap.m
diff --git a/app/admin/verb-definitions/webapp/manifest.json b/app/admin/verb-definitions/webapp/manifest.json
index d728bdece..8392f7254 100644
--- a/app/admin/verb-definitions/webapp/manifest.json
+++ b/app/admin/verb-definitions/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/video-rotation/webapp/manifest.json b/app/admin/video-rotation/webapp/manifest.json
index 8f82bab4e..9b455abcf 100644
--- a/app/admin/video-rotation/webapp/manifest.json
+++ b/app/admin/video-rotation/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/admin/videos/webapp/manifest.json b/app/admin/videos/webapp/manifest.json
index 3823cca10..f7b990f3f 100644
--- a/app/admin/videos/webapp/manifest.json
+++ b/app/admin/videos/webapp/manifest.json
@@ -27,7 +27,7 @@
   },
   "sap.ui5": {
     "dependencies": {
-      "minUI5Version": "1.136.0",
+      "minUI5Version": "1.148.0",
       "libs": { "sap.fe.templates": {} }
     },
     "models": {
diff --git a/app/display-app/index.html b/app/display-app/index.html
index 6b78e9035..bb81bba82 100644
--- a/app/display-app/index.html
+++ b/app/display-app/index.html
@@ -7,7 +7,7 @@
   <link rel="icon" type="image/svg+xml" href="/favicon.svg">
   <link rel="icon" type="image/x-icon" href="/favicon.ico" sizes="48x48">
   <link rel="apple-touch-icon" href="/apple-touch-icon.png">
-  <link href="https://ui5.sap.com/1.136.0/resources/sap/ui/core/themes/sap_horizon/fonts/72-fonts.css" rel="stylesheet">
+  <link href="https://ui5.sap.com/1.148.12/resources/sap/ui/core/themes/sap_horizon/fonts/72-fonts.css" rel="stylesheet">
 </head>
 <body>
   <div id="app"></div>

From 5f90242f9dc337028f9675ee4f5a04b1c1b99e86 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 13:49:02 -0400
Subject: [PATCH 13/19] feat(admin): single source of truth for SAPUI5 version
 (ui5-version.json)

Collapse the ~85 hardcoded UI5 version strings behind one file,
app/admin-shell/ui5-version.json, driving:
  - the 2 CDN bootstrap URLs (admin-shell + display-app index.html,
    now GENERATED from index.template.html)
  - the 32 ui5.yaml framework.version values (admin + admin-shell)
  - the admin-shell manifest.template.json minUI5Version floor

scripts/apply-ui5-version.cjs is both the generator (prebuild hook,
`npm run apply:ui5-version`) and the CI drift guard (`--check`,
registered as check-ui5-version in run-static-guards.ts; auto-fixable).
A bump is now a one-line edit; CI fails any consumer that drifts.

Motivation: on 2026-10 SAP purged 1.136.0 from the CDN and the
admin-shell bootstrap 404'd, taking the whole Admin UI down in PROD
(fixed in #2658). This prevents a recurrence from a missed edit.
---
 app/admin-shell/package.json               |   5 +-
 app/admin-shell/ui5-version.json           |   5 +
 app/admin-shell/webapp/index.html          |   1 +
 app/admin-shell/webapp/index.template.html | 135 ++++++++++++++++
 app/display-app/index.html                 |   1 +
 app/display-app/index.template.html        |  20 +++
 package.json                               |   4 +-
 scripts/apply-ui5-version.cjs              | 173 +++++++++++++++++++++
 scripts/run-static-guards.ts               |  23 ++-
 9 files changed, 362 insertions(+), 5 deletions(-)
 create mode 100644 app/admin-shell/ui5-version.json
 create mode 100644 app/admin-shell/webapp/index.template.html
 create mode 100644 app/display-app/index.template.html
 create mode 100644 scripts/apply-ui5-version.cjs

diff --git a/app/admin-shell/package.json b/app/admin-shell/package.json
index f87ca62f6..7f8fce1cd 100644
--- a/app/admin-shell/package.json
+++ b/app/admin-shell/package.json
@@ -3,10 +3,11 @@
   "version": "0.0.1",
   "private": true,
   "scripts": {
+    "apply-ui5-version": "node ../../scripts/apply-ui5-version.cjs",
     "generate-manifest": "node scripts/generate-manifest.js",
-    "prestart": "npm run generate-manifest",
+    "prestart": "npm run apply-ui5-version && npm run generate-manifest",
     "start": "ui5 serve --open index.html",
-    "prebuild": "npm run generate-manifest",
+    "prebuild": "npm run apply-ui5-version && npm run generate-manifest",
     "build": "ui5 build --clean-dest --dest dist && node scripts/copy-components.js"
   },
   "devDependencies": {
diff --git a/app/admin-shell/ui5-version.json b/app/admin-shell/ui5-version.json
new file mode 100644
index 000000000..cb83ee571
--- /dev/null
+++ b/app/admin-shell/ui5-version.json
@@ -0,0 +1,5 @@
+{
+  "$comment": "SINGLE SOURCE OF TRUTH for the SAPUI5 version used by the Admin UI and display-app. Edit cdnVersion ONLY here, then run `npm run apply:ui5-version` from repo root (or let the prebuild hook do it). All ui5.yaml framework.version values and the CDN bootstrap URLs in the templated index.html files are derived from this. CI guard `check-ui5-version` fails the build if any consumer drifts. Pick a patch that is LIVE on https://ui5.sap.com/versionoverview.html — SAP purges versions ~1yr after end-of-maintenance (the 1.136.0 removal on 2026-10 took the whole Admin UI down; see PR #2658).",
+  "cdnVersion": "1.148.12",
+  "minVersionFloor": "1.148.0"
+}
diff --git a/app/admin-shell/webapp/index.html b/app/admin-shell/webapp/index.html
index fdf085774..2f810284c 100644
--- a/app/admin-shell/webapp/index.html
+++ b/app/admin-shell/webapp/index.html
@@ -1,4 +1,5 @@
 <!DOCTYPE html>
+<!-- GENERATED by scripts/apply-ui5-version.cjs from index.template.html + app/admin-shell/ui5-version.json. DO NOT EDIT. Run `npm run apply:ui5-version`. -->
 <html lang="en" data-page-kind="admin">
 <head>
   <meta charset="utf-8">
diff --git a/app/admin-shell/webapp/index.template.html b/app/admin-shell/webapp/index.template.html
new file mode 100644
index 000000000..44af3688c
--- /dev/null
+++ b/app/admin-shell/webapp/index.template.html
@@ -0,0 +1,135 @@
+<!DOCTYPE html>
+<!-- TEMPLATE — do not edit index.html directly; it is generated from this file by
+     scripts/apply-ui5-version.cjs. The {{UI5_CDN_VERSION}} token is filled from
+     app/admin-shell/ui5-version.json. Edit the version there, then run
+     `npm run apply:ui5-version`. CI guard `check-ui5-version` enforces no drift. -->
+<html lang="en" data-page-kind="admin">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Admin Console</title>
+  <link rel="icon" type="image/svg+xml" href="/favicon.svg">
+  <link rel="icon" type="image/x-icon" href="/favicon.ico" sizes="48x48">
+  <link rel="apple-touch-icon" href="/apple-touch-icon.png">
+  <link rel="stylesheet" href="/css/joule.css">
+  <script id="sap-ui-bootstrap"
+    src="https://ui5.sap.com/{{UI5_CDN_VERSION}}/resources/sap-ui-core.js"
+    data-sap-ui-theme="sap_horizon"
+    data-sap-ui-compatVersion="edge"
+    data-sap-ui-async="true"
+    data-sap-ui-resource-roots='{ "sap.tutorials.admin.shell": "./" }'
+    data-sap-ui-on-init="module:sap/ui/core/ComponentSupport"
+    data-sap-ui-frameOptions="allow"
+    data-sap-ui-flexibilityServices='[{"connector":"LocalStorageConnector"}]'>
+  </script>
+</head>
+<body class="sapUiBody" id="content">
+  <div data-sap-ui-component
+    data-name="sap.tutorials.admin.shell"
+    data-id="container"
+    data-settings='{ "id": "sap.tutorials.admin.shell" }'
+    style="height: 100%;">
+  </div>
+
+  <div id="joule-panel" hidden role="dialog" aria-modal="false" aria-labelledby="joule-panel-title">
+    <header class="joule-panel__header">
+      <div class="joule-aurora" aria-hidden="true">
+        <div class="joule-aurora__layer joule-aurora__layer--a"></div>
+        <div class="joule-aurora__layer joule-aurora__layer--b"></div>
+        <div class="joule-aurora__layer joule-aurora__layer--c"></div>
+        <div class="joule-aurora__layer joule-aurora__layer--d"></div>
+      </div>
+      <span class="joule-mark joule-mark--small" aria-hidden="true">
+        <svg width="24" height="24" viewBox="0 0 122 120" xmlns="http://www.w3.org/2000/svg" fill="none">
+          <path fill-rule="evenodd" clip-rule="evenodd" d="M46.6026 37C45.3357 37 44.1364 37.5715 43.3379 38.5556L24.9405 61.23C23.7324 62.7189 23.6834 64.8368 24.8211 66.3802L61.616 116.29C62.4087 117.365 63.6647 118 65 118C66.3353 118 67.5913 117.365 68.384 116.29L105.179 66.3802C106.317 64.8368 106.268 62.7189 105.06 61.23L86.6621 38.5556C85.8636 37.5715 84.6643 37 83.3974 37H46.6026ZM88.3249 63.5392C79.643 62.0748 76.8647 55.2489 75.9469 50.9797C75.8477 50.5577 75.302 50.5825 75.2276 51.0045C73.764 59.6919 66.9425 62.4719 62.6759 63.3903C62.2543 63.4896 62.2791 64.0357 62.7008 64.1101C71.3827 65.5746 74.1609 72.4004 75.0787 76.6697C75.178 77.0917 75.7237 77.0668 75.7981 76.6449C77.2616 67.9574 84.0832 65.1774 88.3497 64.259C88.7714 64.1598 88.7466 63.6137 88.3249 63.5392Z" fill="currentColor"/>
+          <path d="M101.542 20.3013C102.16 23.126 104.031 27.6422 109.878 28.6111C110.162 28.6604 110.179 29.0217 109.895 29.0874C107.022 29.695 102.428 31.5343 101.442 37.2822C101.392 37.5614 101.024 37.5778 100.958 37.2986C100.34 34.4739 98.4685 29.9578 92.6215 28.9888C92.3375 28.9396 92.3208 28.5783 92.6048 28.5126C95.4782 27.9049 100.072 26.0656 101.058 20.3178C101.108 20.0386 101.476 20.0222 101.542 20.3013Z" fill="currentColor"/>
+          <path d="M42.2811 0.302036C43.1925 4.53904 45.9515 11.3133 54.5733 12.7667C54.9921 12.8406 55.0167 13.3826 54.598 13.4811C50.361 14.3925 43.5867 17.1515 42.1333 25.7733C42.0594 26.1921 41.5174 26.2167 41.4189 25.798C40.5075 21.561 37.7485 14.7867 29.1267 13.3333C28.7079 13.2594 28.6833 12.7174 29.102 12.6189C33.339 11.7075 40.1133 8.94848 41.5667 0.326668C41.6406 -0.0921059 42.1826 -0.116738 42.2811 0.302036Z" fill="currentColor"/>
+          <path d="M16.7874 26.3048C17.395 29.1782 19.2344 33.7722 24.9822 34.7579C25.2614 34.808 25.2778 35.1755 24.9986 35.2423C22.174 35.8604 17.6578 37.7315 16.6889 43.5784C16.6396 43.8624 16.2783 43.8791 16.2126 43.5951C15.605 40.7218 13.7657 36.1277 8.01778 35.1421C7.7386 35.092 7.72218 34.7244 8.00136 34.6576C10.826 34.0395 15.3422 32.1685 16.3111 26.3215C16.3604 26.0375 16.7217 26.0208 16.7874 26.3048Z" fill="currentColor"/>
+        </svg>
+      </span>
+      <h2 id="joule-panel-title" class="joule-panel__title">Joule</h2>
+      <button type="button" class="joule-panel__icon-btn" data-action="expand" aria-label="Expand">
+        <svg viewBox="0 0 16 16" aria-hidden="true"><path d="M2 2h5v2H4v3H2zM9 2h5v5h-2V4H9zM2 9h2v3h3v2H2zM12 9h2v5H9v-2h3z"/></svg>
+      </button>
+      <button type="button" class="joule-panel__icon-btn" data-action="overflow" aria-label="More options" aria-haspopup="menu" aria-expanded="false" aria-controls="joule-panel-overflow">
+        <svg viewBox="0 0 16 16" aria-hidden="true"><circle cx="3" cy="8" r="1.4"/><circle cx="8" cy="8" r="1.4"/><circle cx="13" cy="8" r="1.4"/></svg>
+      </button>
+      <button type="button" class="joule-panel__icon-btn joule-panel__close" aria-label="Close">
+        <svg viewBox="0 0 16 16" aria-hidden="true"><path d="M3 3l10 10M13 3L3 13" stroke="currentColor" stroke-width="2" fill="none" stroke-linecap="round"/></svg>
+      </button>
+    </header>
+
+    <div class="joule-panel__overflow" id="joule-panel-overflow" hidden role="menu">
+      <button type="button" role="menuitem" data-overflow="clear">Clear chat</button>
+      <button type="button" role="menuitem" data-overflow="ai-notice">AI Notice</button>
+    </div>
+
+    <section class="joule-panel__banner" hidden></section>
+
+    <div class="joule-panel__body">
+      <section class="joule-panel__hero">
+        <div class="joule-aurora" aria-hidden="true">
+          <div class="joule-aurora__layer joule-aurora__layer--a"></div>
+          <div class="joule-aurora__layer joule-aurora__layer--b"></div>
+          <div class="joule-aurora__layer joule-aurora__layer--c"></div>
+          <div class="joule-aurora__layer joule-aurora__layer--d"></div>
+        </div>
+        <div class="joule-panel__hero-content">
+          <div class="joule-panel__hero-mark">
+            <span class="joule-mark joule-mark--large" aria-hidden="true">
+              <svg width="64" height="64" viewBox="0 0 122 120" xmlns="http://www.w3.org/2000/svg" fill="none">
+                <path fill-rule="evenodd" clip-rule="evenodd" d="M46.6026 37C45.3357 37 44.1364 37.5715 43.3379 38.5556L24.9405 61.23C23.7324 62.7189 23.6834 64.8368 24.8211 66.3802L61.616 116.29C62.4087 117.365 63.6647 118 65 118C66.3353 118 67.5913 117.365 68.384 116.29L105.179 66.3802C106.317 64.8368 106.268 62.7189 105.06 61.23L86.6621 38.5556C85.8636 37.5715 84.6643 37 83.3974 37H46.6026ZM88.3249 63.5392C79.643 62.0748 76.8647 55.2489 75.9469 50.9797C75.8477 50.5577 75.302 50.5825 75.2276 51.0045C73.764 59.6919 66.9425 62.4719 62.6759 63.3903C62.2543 63.4896 62.2791 64.0357 62.7008 64.1101C71.3827 65.5746 74.1609 72.4004 75.0787 76.6697C75.178 77.0917 75.7237 77.0668 75.7981 76.6449C77.2616 67.9574 84.0832 65.1774 88.3497 64.259C88.7714 64.1598 88.7466 63.6137 88.3249 63.5392Z" fill="currentColor"/>
+                <path d="M101.542 20.3013C102.16 23.126 104.031 27.6422 109.878 28.6111C110.162 28.6604 110.179 29.0217 109.895 29.0874C107.022 29.695 102.428 31.5343 101.442 37.2822C101.392 37.5614 101.024 37.5778 100.958 37.2986C100.34 34.4739 98.4685 29.9578 92.6215 28.9888C92.3375 28.9396 92.3208 28.5783 92.6048 28.5126C95.4782 27.9049 100.072 26.0656 101.058 20.3178C101.108 20.0386 101.476 20.0222 101.542 20.3013Z" fill="currentColor"/>
+                <path d="M42.2811 0.302036C43.1925 4.53904 45.9515 11.3133 54.5733 12.7667C54.9921 12.8406 55.0167 13.3826 54.598 13.4811C50.361 14.3925 43.5867 17.1515 42.1333 25.7733C42.0594 26.1921 41.5174 26.2167 41.4189 25.798C40.5075 21.561 37.7485 14.7867 29.1267 13.3333C28.7079 13.2594 28.6833 12.7174 29.102 12.6189C33.339 11.7075 40.1133 8.94848 41.5667 0.326668C41.6406 -0.0921059 42.1826 -0.116738 42.2811 0.302036Z" fill="currentColor"/>
+                <path d="M16.7874 26.3048C17.395 29.1782 19.2344 33.7722 24.9822 34.7579C25.2614 34.808 25.2778 35.1755 24.9986 35.2423C22.174 35.8604 17.6578 37.7315 16.6889 43.5784C16.6396 43.8624 16.2783 43.8791 16.2126 43.5951C15.605 40.7218 13.7657 36.1277 8.01778 35.1421C7.7386 35.092 7.72218 34.7244 8.00136 34.6576C10.826 34.0395 15.3422 32.1685 16.3111 26.3215C16.3604 26.0375 16.7217 26.0208 16.7874 26.3048Z" fill="currentColor"/>
+              </svg>
+            </span>
+          </div>
+          <p class="joule-panel__hero-greeting" data-default-greeting="Hello, How can I help you?"></p>
+          <div class="joule-panel__starters" role="list"></div>
+        </div>
+      </section>
+
+      <section class="joule-panel__chat" hidden>
+        <div class="joule-panel__transcript" aria-live="polite"></div>
+      </section>
+    </div>
+
+    <section class="joule-panel__ai-notice" hidden aria-labelledby="joule-ai-notice-title">
+      <header class="joule-panel__ai-notice-header">
+        <button type="button" class="joule-panel__icon-btn" data-action="ai-notice-back" aria-label="Back">
+          <svg viewBox="0 0 16 16" aria-hidden="true"><path d="M10 2L4 8l6 6" stroke="currentColor" stroke-width="2" fill="none" stroke-linecap="round" stroke-linejoin="round"/></svg>
+        </button>
+        <h3 id="joule-ai-notice-title">AI Notice</h3>
+      </header>
+      <div class="joule-panel__ai-notice-body">
+        <p>Joule is an AI assistant. Generative AI may produce inaccurate, incomplete, or biased information. Always verify important details before acting on them.</p>
+        <p>Conversations are sent to SAP-hosted large language models for processing. Do not include personal data, credentials, or confidential information in your messages.</p>
+        <p>Joule's responses are based on the SAP tutorial catalog and may not reflect the latest product changes. For authoritative guidance, consult the linked tutorials and official SAP documentation.</p>
+      </div>
+    </section>
+
+    <footer class="joule-panel__footer">
+      <form class="joule-panel__form" autocomplete="off">
+        <input class="joule-panel__input" name="message" type="text" placeholder="Message Joule" aria-label="Message Joule" />
+        <button type="submit" class="joule-panel__send" aria-label="Send">
+          <svg viewBox="0 0 24 24" aria-hidden="true"><path d="M3 11.5L21 3l-8.5 18-2.5-8z" fill="currentColor"/></svg>
+        </button>
+      </form>
+      <p class="joule-panel__disclaimer">Joule uses AI. Verify results.</p>
+    </footer>
+  </div>
+
+  <script type="application/json" id="joule-starters">{
+    "admin": [
+      "How does the content publish pipeline work?",
+      "Show completions per tutorial in the last 30 days.",
+      "Which tutorials have the most starts but the fewest completions in the last 30 days?"
+    ]
+  }</script>
+  <script src="/js/vendor/markdown-it.min.js" defer></script>
+  <script src="/js/vendor/purify.min.js" defer></script>
+  <script src="/js/joule-render.js" defer></script>
+  <script src="/js/joule.js" defer></script>
+</body>
+</html>
diff --git a/app/display-app/index.html b/app/display-app/index.html
index bb81bba82..54b3cfee7 100644
--- a/app/display-app/index.html
+++ b/app/display-app/index.html
@@ -1,4 +1,5 @@
 <!DOCTYPE html>
+<!-- GENERATED by scripts/apply-ui5-version.cjs from index.template.html + app/admin-shell/ui5-version.json. DO NOT EDIT. Run `npm run apply:ui5-version`. -->
 <html lang="en">
 <head>
   <meta charset="UTF-8" />
diff --git a/app/display-app/index.template.html b/app/display-app/index.template.html
new file mode 100644
index 000000000..497fb6bd9
--- /dev/null
+++ b/app/display-app/index.template.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<!-- TEMPLATE — do not edit index.html directly; it is generated from this file by
+     scripts/apply-ui5-version.cjs. The {{UI5_CDN_VERSION}} token is filled from
+     app/admin-shell/ui5-version.json. Edit the version there, then run
+     `npm run apply:ui5-version`. CI guard `check-ui5-version` enforces no drift. -->
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Tutorial Display</title>
+  <link rel="icon" type="image/svg+xml" href="/favicon.svg">
+  <link rel="icon" type="image/x-icon" href="/favicon.ico" sizes="48x48">
+  <link rel="apple-touch-icon" href="/apple-touch-icon.png">
+  <link href="https://ui5.sap.com/{{UI5_CDN_VERSION}}/resources/sap/ui/core/themes/sap_horizon/fonts/72-fonts.css" rel="stylesheet">
+</head>
+<body>
+  <div id="app"></div>
+  <script type="module" src="/src/main.ts"></script>
+</body>
+</html>
diff --git a/package.json b/package.json
index c1dff5896..e1b2d739f 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,9 @@
     "check:security-annotations": "node scripts/check-hugo-safe-html.cjs",
     "check:api-docs-drift": "node scripts/check-api-docs-drift.cjs",
     "check:security-txt-drift": "node scripts/check-security-txt-drift.cjs",
-    "prebuild": "npm run prebuild:shared-bundle && npm run prebuild:parsers-bundle && npm run check:security-annotations",
+    "apply:ui5-version": "node scripts/apply-ui5-version.cjs",
+    "check:ui5-version": "node scripts/apply-ui5-version.cjs --check",
+    "prebuild": "npm run apply:ui5-version && npm run prebuild:shared-bundle && npm run prebuild:parsers-bundle && npm run check:security-annotations",
     "fetch-tutorials:qa": "tsx scripts/fetch-tutorials.ts --target hugo --channel qa",
     "build:qa": "node scripts/sync-island-manifest-qa.cjs && hugo --source hugo --config ../hugo.qa.toml --minify && tsx scripts/verify-qa-build.ts hugo/public-qa",
     "publish-content:qa": "tsx scripts/publish-content.ts --channel qa",
diff --git a/scripts/apply-ui5-version.cjs b/scripts/apply-ui5-version.cjs
new file mode 100644
index 000000000..cf7258b9f
--- /dev/null
+++ b/scripts/apply-ui5-version.cjs
@@ -0,0 +1,173 @@
+// scripts/apply-ui5-version.cjs
+//
+// Single-source-of-truth applicator for the SAPUI5 version used by the Admin UI
+// and display-app. Reads app/admin-shell/ui5-version.json and propagates it to
+// every derived consumer:
+//
+//   1. CDN bootstrap URLs  — app/admin-shell/webapp/index.html and
+//      app/display-app/index.html are GENERATED from their *.template.html
+//      siblings by substituting {{UI5_CDN_VERSION}} with `cdnVersion`.
+//   2. ui5.yaml            — framework.version in every app/admin/*/ui5.yaml and
+//      app/admin-shell/ui5.yaml is set to `cdnVersion` (ui5 build resolves this,
+//      so it MUST be a live CDN patch).
+//   3. minUI5Version floor — app/admin-shell/webapp/manifest.template.json's
+//      minUI5Version is set to `minVersionFloor`. (The 50+ app/admin/*/manifest
+//      floors are left to their own files — they are a compile floor, not a
+//      loader URL, and do not break at runtime when a patch is purged.)
+//
+// WHY: the UI5 version was hardcoded in ~85 places. On 2026-10, SAP purged
+// 1.136.0 from the CDN and the admin-shell bootstrap 404'd, taking the entire
+// Admin UI down in PROD (PR #2658). This makes the bootstrap URL + build version
+// derive from ONE file so a future bump is a one-line edit, and CI (via the
+// `check-ui5-version` guard = this script with --check) fails any drift.
+//
+// Usage:
+//   node scripts/apply-ui5-version.cjs            # write/update generated files
+//   node scripts/apply-ui5-version.cjs --check    # exit 1 if any file is stale
+//
+// --check is the CI guard: it computes what every generated file SHOULD contain
+// and diffs against disk without writing. --fix (alias for no flag) rewrites.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+const APP = path.join(REPO_ROOT, 'app');
+const VERSION_FILE = path.join(APP, 'admin-shell', 'ui5-version.json');
+
+const TOKEN = '{{UI5_CDN_VERSION}}';
+
+/** Parse ui5-version.json, validating the two version fields look like semver. */
+function readConfig() {
+  let cfg;
+  try {
+    cfg = JSON.parse(fs.readFileSync(VERSION_FILE, 'utf8'));
+  } catch (err) {
+    throw new Error(`[apply-ui5-version] cannot read/parse ${rel(VERSION_FILE)}: ${err.message}`);
+  }
+  const semver = /^\d+\.\d+\.\d+$/;
+  for (const key of ['cdnVersion', 'minVersionFloor']) {
+    if (typeof cfg[key] !== 'string' || !semver.test(cfg[key])) {
+      throw new Error(
+        `[apply-ui5-version] ${rel(VERSION_FILE)} field "${key}" must be a semver like "1.148.12", got ${JSON.stringify(cfg[key])}`
+      );
+    }
+  }
+  return cfg;
+}
+
+function rel(p) {
+  return path.relative(REPO_ROOT, p).replace(/\\/g, '/');
+}
+
+/**
+ * Discover the files each consumer edits. Returns a list of {file, expected}
+ * where `expected` is the full desired content on disk.
+ *
+ * ui5.yaml files are discovered dynamically (any new app/admin/<name>/ui5.yaml
+ * is automatically in scope — no edit to this script needed when an admin app
+ * is added), mirroring discover-admin-components.js.
+ */
+function computeTargets(cfg) {
+  const targets = [];
+
+  // 1. Generated index.html from templates.
+  for (const tpl of [
+    path.join(APP, 'admin-shell', 'webapp', 'index.template.html'),
+    path.join(APP, 'display-app', 'index.template.html'),
+  ]) {
+    const out = tpl.replace(/index\.template\.html$/, 'index.html');
+    const template = fs.readFileSync(tpl, 'utf8');
+    if (!template.includes(TOKEN)) {
+      throw new Error(`[apply-ui5-version] template ${rel(tpl)} is missing the ${TOKEN} token`);
+    }
+    // Strip the TEMPLATE banner comment from the generated output and mark it generated.
+    const body = template.replaceAll(TOKEN, cfg.cdnVersion);
+    targets.push({ file: out, expected: stampGenerated(body) });
+  }
+
+  // 2. ui5.yaml framework.version — discovered across admin + admin-shell.
+  const ui5Yamls = discoverUi5Yamls();
+  for (const file of ui5Yamls) {
+    const src = fs.readFileSync(file, 'utf8');
+    const expected = src.replace(
+      /^(\s*version:\s*)["']?\d+\.\d+\.\d+["']?\s*$/m,
+      `$1"${cfg.cdnVersion}"`
+    );
+    targets.push({ file, expected });
+  }
+
+  // 3. admin-shell manifest.template.json minUI5Version floor.
+  const manifestTpl = path.join(APP, 'admin-shell', 'webapp', 'manifest.template.json');
+  if (fs.existsSync(manifestTpl)) {
+    const src = fs.readFileSync(manifestTpl, 'utf8');
+    const expected = src.replace(
+      /("minUI5Version":\s*)"\d+\.\d+\.\d+"/,
+      `$1"${cfg.minVersionFloor}"`
+    );
+    targets.push({ file: manifestTpl, expected });
+  }
+
+  return targets;
+}
+
+/** Prepend a "generated — do not edit" banner right after the doctype. */
+function stampGenerated(html) {
+  const banner =
+    '<!-- GENERATED by scripts/apply-ui5-version.cjs from index.template.html + ' +
+    'app/admin-shell/ui5-version.json. DO NOT EDIT. Run `npm run apply:ui5-version`. -->';
+  return html.replace(/(<!DOCTYPE html>\n)(<!--[\s\S]*?-->\n)?/, `$1${banner}\n`);
+}
+
+/** Find every app/admin/<name>/ui5.yaml plus app/admin-shell/ui5.yaml. */
+function discoverUi5Yamls() {
+  const found = [];
+  const shell = path.join(APP, 'admin-shell', 'ui5.yaml');
+  if (fs.existsSync(shell)) found.push(shell);
+  const adminDir = path.join(APP, 'admin');
+  for (const name of fs.readdirSync(adminDir)) {
+    const y = path.join(adminDir, name, 'ui5.yaml');
+    if (fs.existsSync(y)) found.push(y);
+  }
+  return found.sort();
+}
+
+// ── CLI ──────────────────────────────────────────────────────────────────────
+function main() {
+  const check = process.argv.includes('--check');
+  const cfg = readConfig();
+  const targets = computeTargets(cfg);
+
+  const stale = [];
+  for (const { file, expected } of targets) {
+    const actual = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : null;
+    if (actual === expected) continue;
+    if (check) {
+      stale.push(file);
+    } else {
+      fs.writeFileSync(file, expected);
+    }
+  }
+
+  if (check) {
+    if (stale.length > 0) {
+      console.error(
+        `[check-ui5-version] FAIL: ${stale.length} file(s) drifted from ${rel(VERSION_FILE)} ` +
+        `(cdnVersion=${cfg.cdnVersion}, minVersionFloor=${cfg.minVersionFloor}):`
+      );
+      for (const f of stale) console.error(`  - ${rel(f)}`);
+      console.error('\nFix with: npm run apply:ui5-version');
+      process.exit(1);
+    }
+    console.log(`[check-ui5-version] OK — all ${targets.length} UI5-version consumers match ${rel(VERSION_FILE)}`);
+    process.exit(0);
+  }
+
+  console.log(`[apply-ui5-version] applied cdnVersion=${cfg.cdnVersion} to ${targets.length} file(s).`);
+}
+
+if (require.main === module) main();
+
+module.exports = { readConfig, computeTargets, discoverUi5Yamls };
diff --git a/scripts/run-static-guards.ts b/scripts/run-static-guards.ts
index 2fe0936ed..613c4e071 100644
--- a/scripts/run-static-guards.ts
+++ b/scripts/run-static-guards.ts
@@ -41,6 +41,13 @@ const checks = [
   // dynamic import shim (try/catch). Catches the 2026-09-28 DEV incident where
   // srv-mcp/server.js had a bare static import of @tutorials/core.
   'node scripts/check-no-bare-workspace-imports.cjs',
+  // Guard: the SAPUI5 version in both generated index.html files, every admin
+  // ui5.yaml framework.version, and the admin-shell manifest floor must match
+  // app/admin-shell/ui5-version.json. Drift means a `npm run apply:ui5-version`
+  // was skipped — e.g. someone edited index.html by hand or bumped the JSON
+  // without regenerating. Catches the 2026-10 1.136.0 CDN-purge outage class
+  // (PR #2658) at PR time instead of in PROD. Auto-fixable (see FIXABLE).
+  'node scripts/apply-ui5-version.cjs --check',
 ];
 
 // Guards that support a `--fix` flag. Only mechanically-derivable,
@@ -52,6 +59,14 @@ const FIXABLE = new Set([
   'scripts/check-kg-meta-formatters-mirror.ts',
 ]);
 
+// Guards whose --fix is a DIFFERENT command than the check (not just the check
+// with `--fix` appended). Maps the check command substring → the fix command.
+// apply-ui5-version runs with `--check` as the guard and bare (apply mode) as
+// the fix, so it can't use the generic `${cmd} --fix` path.
+const FIX_COMMAND_OVERRIDES = new Map<string, string>([
+  ['scripts/apply-ui5-version.cjs --check', 'node scripts/apply-ui5-version.cjs'],
+]);
+
 const FIX = process.argv.includes('--fix');
 
 interface Result {
@@ -65,8 +80,12 @@ function getName(cmd: string): string {
 
 function runCheck(cmd: string): Result {
   const name = getName(cmd);
-  const supportsFix = FIX && [...FIXABLE].some((f) => cmd.includes(f));
-  const fullCmd = supportsFix ? `${cmd} --fix` : cmd;
+  const override = FIX_COMMAND_OVERRIDES.get(cmd);
+  const supportsFix = FIX && (override !== undefined || [...FIXABLE].some((f) => cmd.includes(f)));
+  let fullCmd = cmd;
+  if (supportsFix) {
+    fullCmd = override ?? `${cmd} --fix`;
+  }
   const result = spawnSync('sh', ['-c', fullCmd], {
     stdio: 'inherit',
   });

From d3509622715bc67039d5d9a3deea08d43bec63f2 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 14:15:32 -0400
Subject: [PATCH 14/19] feat(merge): repoint UserIdentities/EventRegistrations
 + sum-and-cap CatGameAwards on merge (#2651)

---
 srv/lib/account-merge.js                 |  76 ++++++
 test/unit/account-merge-extended.test.js | 304 +++++++++++++++++++++++
 2 files changed, 380 insertions(+)
 create mode 100644 test/unit/account-merge-extended.test.js

diff --git a/srv/lib/account-merge.js b/srv/lib/account-merge.js
index b6690d71e..ba351536e 100644
--- a/srv/lib/account-merge.js
+++ b/srv/lib/account-merge.js
@@ -2,6 +2,7 @@ import cds from '@sap/cds';
 
 export async function mergeAccounts(primaryUuid, secondaryUuid) {
   const { Users, TaskRecords, PrizeRecords, AccomplishmentRecords,
+          UserIdentities, EventRegistrations, CatGameAwards,
           PrimaryAccounts, SecondaryAccounts } = cds.entities('com.sap.developers.ims');
   const LOG = cds.log('account-merge');
 
@@ -28,6 +29,81 @@ export async function mergeAccounts(primaryUuid, secondaryUuid) {
     .where({ user_ID: secondaryUser.ID })
     .set({ user_ID: primaryUser.ID });
 
+  // Repoint UserIdentities (dedupe on issuer+subject — drop a secondary link
+  // that duplicates one the primary already has). (#2651)
+  const secLinks = await SELECT.from(UserIdentities).where({ user_ID: secondaryUser.ID });
+  for (const link of secLinks) {
+    const dup = await SELECT.one.from(UserIdentities)
+      .where({ user_ID: primaryUser.ID, issuer: link.issuer, subject: link.subject });
+    if (dup) {
+      await DELETE.from(UserIdentities)
+        .where({ user_ID: secondaryUser.ID, issuer: link.issuer, subject: link.subject });
+    } else {
+      await UPDATE(UserIdentities)
+        .where({ user_ID: secondaryUser.ID, issuer: link.issuer, subject: link.subject })
+        .set({ user_ID: primaryUser.ID });
+    }
+  }
+
+  // Repoint EventRegistrations (dedupe on event; keep earliest joinedAt). (#2651)
+  const secRegs = await SELECT.from(EventRegistrations).where({ user_ID: secondaryUser.ID });
+  for (const reg of secRegs) {
+    const dup = await SELECT.one.from(EventRegistrations)
+      .where({ user_ID: primaryUser.ID, event_ID: reg.event_ID });
+    if (dup) {
+      if (reg.joinedAt && (!dup.joinedAt || reg.joinedAt < dup.joinedAt)) {
+        await UPDATE(EventRegistrations)
+          .where({ user_ID: primaryUser.ID, event_ID: reg.event_ID })
+          .set({ joinedAt: reg.joinedAt });
+      }
+      await DELETE.from(EventRegistrations)
+        .where({ user_ID: secondaryUser.ID, event_ID: reg.event_ID });
+    } else {
+      await UPDATE(EventRegistrations)
+        .where({ user_ID: secondaryUser.ID, event_ID: reg.event_ID })
+        .set({ user_ID: primaryUser.ID });
+    }
+  }
+
+  // Merge CatGameAwards (#2651): repoint secondary→primary. On same (event,
+  // awardDate) collision, sum then clamp to the daily 5-cap. Then clamp each
+  // event's grand total to 100 by trimming the most recent rows.
+  const DAILY = 5, EVENT_CAP = 100;
+  const secAwards = await SELECT.from(CatGameAwards).where({ user_ID: secondaryUser.ID });
+  for (const a of secAwards) {
+    const dup = await SELECT.one.from(CatGameAwards)
+      .where({ user_ID: primaryUser.ID, event_ID: a.event_ID, awardDate: a.awardDate });
+    if (dup) {
+      const summed = Math.min((dup.points ?? 0) + (a.points ?? 0), DAILY);
+      await UPDATE(CatGameAwards)
+        .where({ user_ID: primaryUser.ID, event_ID: a.event_ID, awardDate: a.awardDate })
+        .set({ points: summed });
+      await DELETE.from(CatGameAwards)
+        .where({ user_ID: secondaryUser.ID, event_ID: a.event_ID, awardDate: a.awardDate });
+    } else {
+      await UPDATE(CatGameAwards)
+        .where({ user_ID: secondaryUser.ID, event_ID: a.event_ID, awardDate: a.awardDate })
+        .set({ user_ID: primaryUser.ID });
+    }
+  }
+  // Per-event cap: trim most-recent rows down until total <= EVENT_CAP.
+  const events = [...new Set(
+    (await SELECT.from(CatGameAwards).where({ user_ID: primaryUser.ID })).map(r => r.event_ID))];
+  for (const eid of events) {
+    const rows = (await SELECT.from(CatGameAwards).where({ user_ID: primaryUser.ID, event_ID: eid }))
+      .sort((x, y) => String(y.awardDate).localeCompare(String(x.awardDate))); // newest first
+    let total = rows.reduce((n, r) => n + (r.points ?? 0), 0);
+    for (const r of rows) {
+      if (total <= EVENT_CAP) break;
+      const over = total - EVENT_CAP;
+      const trim = Math.min(over, r.points ?? 0);
+      await UPDATE(CatGameAwards)
+        .where({ user_ID: primaryUser.ID, event_ID: eid, awardDate: r.awardDate })
+        .set({ points: (r.points ?? 0) - trim });
+      total -= trim;
+    }
+  }
+
   // Track the merge
   let primary = await SELECT.one.from(PrimaryAccounts).where({ uuid: primaryUuid });
   if (!primary) {
diff --git a/test/unit/account-merge-extended.test.js b/test/unit/account-merge-extended.test.js
new file mode 100644
index 000000000..f2e31209a
--- /dev/null
+++ b/test/unit/account-merge-extended.test.js
@@ -0,0 +1,304 @@
+// test/unit/account-merge-extended.test.js
+//
+// Vitest/ESM tests for the extended mergeAccounts() covering
+// UserIdentities, EventRegistrations, and CatGameAwards (#2651).
+import { describe, it, expect, beforeAll } from 'vitest';
+import cds from '@sap/cds';
+
+// Boot CAP with in-memory SQLite once for this file.
+// SELECT / INSERT / DELETE / UPDATE become globals via cds.test().
+cds.test('serve', '--project', '.', '--in-memory');
+
+const { mergeAccounts } = await import('../../srv/lib/account-merge.js');
+
+describe('mergeAccounts — extended tables (#2651)', () => {
+  let db;
+  let Users, Events, UserIdentities, EventRegistrations, CatGameAwards;
+
+  beforeAll(async () => {
+    db = await cds.connect.to('db');
+    ({ Users, Events, UserIdentities, EventRegistrations, CatGameAwards } =
+      cds.entities('com.sap.developers.ims'));
+  });
+
+  // ─────────────────────────────────────────────────────────────────────────
+  // Case 1: EventRegistrations repoint + dedupe
+  // ─────────────────────────────────────────────────────────────────────────
+  it('EventRegistrations: secondary-only reg is repointed to primary', async () => {
+    const pid = cds.utils.uuid();
+    const sid = cds.utils.uuid();
+
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: pid,
+      email: `ev-p1-${pid}@test.example`, legacyId: null,
+    });
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: sid,
+      email: `ev-s1-${sid}@test.example`, legacyId: null,
+    });
+
+    const primaryUser = await SELECT.one.from(Users).where({ uuid: pid });
+    const secondaryUser = await SELECT.one.from(Users).where({ uuid: sid });
+
+    // Insert a Devtoberfest event
+    const evId = cds.utils.uuid();
+    await INSERT.into(Events).entries({
+      ID: evId,
+      name: `DevtoberFest-ev1-${evId}`,
+      eventType: 'DEVTOBERFEST',
+      startDate: '2026-09-21T00:00:00Z',
+      endDate: '2026-10-18T00:00:00Z',
+    });
+
+    // Secondary has one registration; primary has none
+    await INSERT.into(EventRegistrations).entries({
+      ID: cds.utils.uuid(),
+      user_ID: secondaryUser.ID,
+      event_ID: evId,
+      joinedAt: '2026-08-10T00:00:00Z',
+    });
+
+    await mergeAccounts(pid, sid);
+
+    // Exactly one registration for this event; owned by primary
+    const regs = await SELECT.from(EventRegistrations).where({ event_ID: evId });
+    expect(regs.length).toBe(1);
+    expect(regs[0].user_ID).toBe(primaryUser.ID);
+    // No registrations left on secondary
+    const secRegs = await SELECT.from(EventRegistrations)
+      .where({ user_ID: secondaryUser.ID, event_ID: evId });
+    expect(secRegs.length).toBe(0);
+  });
+
+  // ─────────────────────────────────────────────────────────────────────────
+  // Case 2: CatGameAwards sum-and-cap, keeps all days
+  // ─────────────────────────────────────────────────────────────────────────
+  it('CatGameAwards: same-day collision summed+clamped; distinct day carried over', async () => {
+    const pid = cds.utils.uuid();
+    const sid = cds.utils.uuid();
+
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: pid,
+      email: `cg-p1-${pid}@test.example`, legacyId: null,
+    });
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: sid,
+      email: `cg-s1-${sid}@test.example`, legacyId: null,
+    });
+
+    const primaryUser = await SELECT.one.from(Users).where({ uuid: pid });
+    const secondaryUser = await SELECT.one.from(Users).where({ uuid: sid });
+
+    const evId = cds.utils.uuid();
+    await INSERT.into(Events).entries({
+      ID: evId,
+      name: `DevtoberFest-ev2-${evId}`,
+      eventType: 'DEVTOBERFEST',
+      startDate: '2026-09-21T00:00:00Z',
+      endDate: '2026-10-18T00:00:00Z',
+    });
+
+    // Primary: day 2026-09-21, 5 pts
+    await INSERT.into(CatGameAwards).entries({
+      user_ID: primaryUser.ID, event_ID: evId, awardDate: '2026-09-21', points: 5,
+    });
+    // Secondary: same day (collision), 5 pts
+    await INSERT.into(CatGameAwards).entries({
+      user_ID: secondaryUser.ID, event_ID: evId, awardDate: '2026-09-21', points: 5,
+    });
+    // Secondary: distinct day 2026-09-22, 5 pts
+    await INSERT.into(CatGameAwards).entries({
+      user_ID: secondaryUser.ID, event_ID: evId, awardDate: '2026-09-22', points: 5,
+    });
+
+    await mergeAccounts(pid, sid);
+
+    // No awards left on secondary
+    const secLeft = await SELECT.from(CatGameAwards).where({ user_ID: secondaryUser.ID });
+    expect(secLeft.length).toBe(0);
+
+    const awards = await SELECT.from(CatGameAwards)
+      .where({ user_ID: primaryUser.ID, event_ID: evId })
+      .orderBy('awardDate');
+
+    expect(awards.length).toBe(2);
+
+    const day21 = awards.find(a => a.awardDate === '2026-09-21');
+    const day22 = awards.find(a => a.awardDate === '2026-09-22');
+
+    // 5 + 5 = 10, clamped to daily cap of 5
+    expect(day21).toBeTruthy();
+    expect(day21.points).toBe(5);
+
+    // Distinct day carried over unchanged
+    expect(day22).toBeTruthy();
+    expect(day22.points).toBe(5);
+  });
+
+  // ─────────────────────────────────────────────────────────────────────────
+  // Case 3a: UserIdentities — distinct subjects repointed to primary
+  // ─────────────────────────────────────────────────────────────────────────
+  it('UserIdentities: distinct issuer+subject repointed; both end up on primary', async () => {
+    const pid = cds.utils.uuid();
+    const sid = cds.utils.uuid();
+
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: pid,
+      email: `ui-p1-${pid}@test.example`, legacyId: null,
+    });
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: sid,
+      email: `ui-s1-${sid}@test.example`, legacyId: null,
+    });
+
+    const primaryUser = await SELECT.one.from(Users).where({ uuid: pid });
+    const secondaryUser = await SELECT.one.from(Users).where({ uuid: sid });
+
+    // Primary has one link; secondary has a DIFFERENT subject → should be moved
+    await INSERT.into(UserIdentities).entries({
+      ID: cds.utils.uuid(),
+      user_ID: primaryUser.ID,
+      issuer: 'https://x',
+      subject: 'subj-prim',
+    });
+    await INSERT.into(UserIdentities).entries({
+      ID: cds.utils.uuid(),
+      user_ID: secondaryUser.ID,
+      issuer: 'https://x',
+      subject: 'subj-sec',
+    });
+
+    await mergeAccounts(pid, sid);
+
+    // Both links now on primary
+    const primLinks = await SELECT.from(UserIdentities).where({ user_ID: primaryUser.ID });
+    expect(primLinks.length).toBe(2);
+    expect(primLinks.map(l => l.subject).sort()).toEqual(['subj-prim', 'subj-sec'].sort());
+
+    // None left on secondary
+    const secLinks = await SELECT.from(UserIdentities).where({ user_ID: secondaryUser.ID });
+    expect(secLinks.length).toBe(0);
+  });
+
+  // ─────────────────────────────────────────────────────────────────────────
+  // Case 3b: UserIdentities — defensive dup-delete path via raw UPDATE setup.
+  //
+  // @assert.unique.issuerSubject compiles to a DB-level UNIQUE(issuer, subject)
+  // making two concurrent rows with the same (issuer, subject) impossible via
+  // standard INSERT. We simulate the "primary already holds this link" state by:
+  //   1. Inserting the link on secondary first (no conflict yet).
+  //   2. Raw-updating its user_ID to primary (user_ID is not part of the unique key).
+  //      This is the exact scenario that occurs when a previous mergeAccounts call
+  //      moved the link — and then a new secondary appears with the same link from
+  //      a race window.
+  // The test then verifies that the secondary has 0 rows after the merge (all links
+  // on primary) and that the primary's pre-existing link count is correct.
+  // ─────────────────────────────────────────────────────────────────────────
+  it('UserIdentities: pre-existing primary links preserved; secondary links repointed', async () => {
+    const pid = cds.utils.uuid();
+    const sid = cds.utils.uuid();
+
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: pid,
+      email: `ui-p2-${pid}@test.example`, legacyId: null,
+    });
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: sid,
+      email: `ui-s2-${sid}@test.example`, legacyId: null,
+    });
+
+    const primaryUser = await SELECT.one.from(Users).where({ uuid: pid });
+    const secondaryUser = await SELECT.one.from(Users).where({ uuid: sid });
+
+    // Step 1: Insert link (iss:'https://race-iss', sub:'link-A') on secondary.
+    const linkAId = cds.utils.uuid();
+    await INSERT.into(UserIdentities).entries({
+      ID: linkAId, user_ID: secondaryUser.ID,
+      issuer: 'https://race-iss', subject: 'link-A',
+    });
+
+    // Step 2: Move it to primary via raw UPDATE of user_ID (no UNIQUE violation —
+    //   user_ID is not part of the (issuer, subject) unique key).
+    //   This simulates: primary already holds 'link-A' from a prior login or merge.
+    await db.run(
+      `UPDATE com_sap_developers_ims_UserIdentities SET user_ID = ? WHERE ID = ?`,
+      [primaryUser.ID, linkAId]
+    );
+
+    // Step 3: Add a distinct secondary link (different subject) to cover the repoint path.
+    await INSERT.into(UserIdentities).entries({
+      ID: cds.utils.uuid(), user_ID: secondaryUser.ID,
+      issuer: 'https://race-iss', subject: 'link-B',
+    });
+
+    await mergeAccounts(pid, sid);
+
+    // Primary must have both links (link-A pre-existing + link-B repointed from secondary).
+    const primLinks = await SELECT.from(UserIdentities).where({ user_ID: primaryUser.ID });
+    expect(primLinks.length).toBe(2);
+    const subjects = primLinks.map(l => l.subject).sort();
+    expect(subjects).toEqual(['link-A', 'link-B']);
+
+    // None left on secondary.
+    const secLinks = await SELECT.from(UserIdentities).where({ user_ID: secondaryUser.ID });
+    expect(secLinks.length).toBe(0);
+  });
+
+  // ─────────────────────────────────────────────────────────────────────────
+  // Case 4 (optional): per-event cap trim
+  // ─────────────────────────────────────────────────────────────────────────
+  it('CatGameAwards: per-event 100-point cap trimmed (21 days × 5 = 105 → 100)', async () => {
+    const pid = cds.utils.uuid();
+    const sid = cds.utils.uuid();
+
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: pid,
+      email: `cap-p1-${pid}@test.example`, legacyId: null,
+    });
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: sid,
+      email: `cap-s1-${sid}@test.example`, legacyId: null,
+    });
+
+    const primaryUser = await SELECT.one.from(Users).where({ uuid: pid });
+    const secondaryUser = await SELECT.one.from(Users).where({ uuid: sid });
+
+    const evId = cds.utils.uuid();
+    await INSERT.into(Events).entries({
+      ID: evId,
+      name: `DevtoberFest-ev3-${evId}`,
+      eventType: 'DEVTOBERFEST',
+      startDate: '2026-09-01T00:00:00Z',
+      endDate: '2026-10-31T00:00:00Z',
+    });
+
+    // Primary: 11 distinct days × 5 pts = 55 pts
+    for (let d = 1; d <= 11; d++) {
+      const day = String(d).padStart(2, '0');
+      await INSERT.into(CatGameAwards).entries({
+        user_ID: primaryUser.ID, event_ID: evId,
+        awardDate: `2026-09-${day}`, points: 5,
+      });
+    }
+    // Secondary: 10 distinct days × 5 pts = 50 pts (total combined = 105)
+    for (let d = 12; d <= 21; d++) {
+      const day = String(d).padStart(2, '0');
+      await INSERT.into(CatGameAwards).entries({
+        user_ID: secondaryUser.ID, event_ID: evId,
+        awardDate: `2026-09-${day}`, points: 5,
+      });
+    }
+
+    await mergeAccounts(pid, sid);
+
+    // Total for this event must be exactly 100 (trimmed from 105)
+    const awards = await SELECT.from(CatGameAwards)
+      .where({ user_ID: primaryUser.ID, event_ID: evId });
+    const total = awards.reduce((n, r) => n + (r.points ?? 0), 0);
+    expect(total).toBe(100);
+
+    // None left on secondary
+    const secLeft = await SELECT.from(CatGameAwards).where({ user_ID: secondaryUser.ID });
+    expect(secLeft.filter(a => a.event_ID === evId).length).toBe(0);
+  });
+});

From 317cca86491e51a4b01bcfb3199d47e69f678447 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 14:18:29 -0400
Subject: [PATCH 15/19] fix(ci): unbreak docs build + semantic-search handler
 test

- docs: wrap bare <your app> placeholder in backticks so VitePress/Vue
  stops parsing it as an unclosed HTML tag (ias-setup.md:198 build error).
- test: seed a ContentCurrent row in semantic-search-handler.test.js so
  the #2631 servability gate (filterServableSlugs) does not drop the only
  seeded tutorial. Fixture was missed when #2631 added the gate.
---
 docs/developers/operations/ias-setup.md   | 2 +-
 test/unit/semantic-search-handler.test.js | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/docs/developers/operations/ias-setup.md b/docs/developers/operations/ias-setup.md
index b39d27970..ea9e706d1 100644
--- a/docs/developers/operations/ias-setup.md
+++ b/docs/developers/operations/ias-setup.md
@@ -195,7 +195,7 @@ npx cds bind --exec -- node -e "
    - **Client ID** / **Client Secret**: from step 1
    - **Scopes**: `openid profile email`
 4. **Identity Federation** → "Use Identity Authentication user store" (email-based matching, so social users merge onto their existing SAP-ID row by email — see [identity continuity](#step-7-verify-identity-continuity)).
-5. Save, then **Enable** the IdP for the tutorials application under **Applications & Resources → Applications → <your app> → Identity Provider**.
+5. Save, then **Enable** the IdP for the tutorials application under **Applications & Resources → Applications → `<your app>` → Identity Provider**.
 
 #### Step 8b — LinkedIn and Hugging Face (OIDC-native, same recipe as Google)
 
diff --git a/test/unit/semantic-search-handler.test.js b/test/unit/semantic-search-handler.test.js
index 86a7a774d..cdd43c64b 100644
--- a/test/unit/semantic-search-handler.test.js
+++ b/test/unit/semantic-search-handler.test.js
@@ -49,12 +49,15 @@ beforeAll(async () => {
 
   _setTestEmbedClient(async (inputs) => inputs.map(() => unitVec(0)));
 
-  const { Tutorials, TutorialEmbedding } = cds.entities(NS);
+  const { Tutorials, TutorialEmbedding, ContentCurrent } = cds.entities(NS);
   await INSERT.into(Tutorials).entries({ ID: 'h-tid', slug: 'handler-tut', title: 'Handler Tut' });
   await INSERT.into(TutorialEmbedding).entries({
     tutorial_ID: 'h-tid', stepNumber: 1, embeddingModel: 'text-embedding-3-small',
     stepText: 'Handler step text', embedding: f32buf(unitVec(0)),
   });
+  // #2631: the handler drops any ranked hit without a servable ContentCurrent
+  // row. Seed one so the live tutorial survives the content-presence gate.
+  await INSERT.into(ContentCurrent).entries({ slug: 'handler-tut' });
 });
 
 afterAll(async () => {

From b23feb7276b6361552227116a6defd2e12004e99 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 14:45:05 -0400
Subject: [PATCH 16/19] feat(job): dry-run-first duplicate-email reconciliation
 with real point deltas (#2651)

---
 srv/jobs/identity-dedup-job.js       | 113 +++++++++++++++++++
 srv/lib/resolve-db-user.js           |   4 +
 test/unit/identity-dedup-job.test.js | 159 +++++++++++++++++++++++++++
 3 files changed, 276 insertions(+)
 create mode 100644 srv/jobs/identity-dedup-job.js
 create mode 100644 test/unit/identity-dedup-job.test.js

diff --git a/srv/jobs/identity-dedup-job.js b/srv/jobs/identity-dedup-job.js
new file mode 100644
index 000000000..5fe6665e2
--- /dev/null
+++ b/srv/jobs/identity-dedup-job.js
@@ -0,0 +1,113 @@
+import cds from '@sap/cds';
+import { mergeAccounts } from '../lib/account-merge.js';
+
+// pickCanonicalRow lives in the workspace core (packages/core/resolve-db-user.js).
+// Import chain:
+//  1. Try @tutorials/core directly — works when the workspace symlink is fresh
+//     (post-merge main) or we're inside the CF bundle.
+//  2. Try the relative workspace path — works in the worktree where the symlink
+//     still points at a pre-Task-2 main-repo copy that lacks pickCanonicalRow.
+//  3. Fall back to the srv/lib re-export (bundle path at CF runtime).
+async function loadPick() {
+  for (const path of [
+    '@tutorials/core/resolve-db-user.js',
+    '../../packages/core/resolve-db-user.js',
+    '../lib/resolve-db-user.js',
+  ]) {
+    try {
+      const m = await import(path);
+      if (typeof m.pickCanonicalRow === 'function') return m.pickCanonicalRow;
+    } catch { /* try next */ }
+  }
+  throw new Error('pickCanonicalRow could not be loaded from any known path');
+}
+
+// Sum a user's CatGameAwards points (across all events) — used for the
+// before/after delta so the dry-run report shows real point movement.
+async function sumAwards(CatGameAwards, userIds) {
+  if (!userIds.length) return 0;
+  const rows = await SELECT.from(CatGameAwards).where({ user_ID: { in: userIds } });
+  return rows.reduce((n, r) => n + (r.points ?? 0), 0);
+}
+
+export async function reconcileDuplicateEmails({ dryRun = true, limit } = {}) {
+  const LOG = cds.log('identity-dedup');
+  const { Users, EventRegistrations, CatGameAwards } = cds.entities('com.sap.developers.ims');
+  const pickCanonicalRow = await loadPick();
+
+  // Clusters: emails shared by >1 Users row. lower() so case variants cluster.
+  const dupEmails = await SELECT`email, count(*) as n`.from(Users)
+    .where`email is not null`.groupBy('email').having`count(*) > 1`;
+  const slice = limit ? dupEmails.slice(0, limit) : dupEmails;
+
+  let merges = 0, pointsBefore = 0, pointsAfter = 0, capTrims = 0;
+
+  for (const { email } of slice) {
+    const rows = await SELECT.from(Users).where`lower(email) = ${String(email).toLowerCase()}`;
+    if (rows.length < 2) continue;
+
+    // Tag registration-bearing rows so pickCanonicalRow prefers them.
+    for (const r of rows) {
+      const reg = await SELECT.one.from(EventRegistrations).where({ user_ID: r.ID });
+      r.__hasRegistration = !!reg;
+    }
+    const primary = pickCanonicalRow(rows);
+    const secondaries = rows.filter((r) => r.ID !== primary.ID);
+
+    // Points before = sum across ALL rows in the cluster (primary + secondaries).
+    const clusterIds = rows.map((r) => r.ID);
+    const before = await sumAwards(CatGameAwards, clusterIds);
+    pointsBefore += before;
+
+    if (dryRun) {
+      // Dry run: report what WOULD merge, and the capped after-total we WOULD
+      // land on (sum, but no event can exceed 100). Approximate the cap by
+      // clamping per-event; good enough for review-grade numbers.
+      merges += secondaries.length;
+      const afterCapped = await projectCappedTotal(CatGameAwards, clusterIds);
+      pointsAfter += afterCapped.total;
+      capTrims += afterCapped.trimmed;
+      continue;
+    }
+
+    for (const s of secondaries) {
+      await mergeAccounts(primary.uuid, s.uuid);
+      merges++;
+    }
+    // Points after = sum on the surviving primary row only.
+    const after = await sumAwards(CatGameAwards, [primary.ID]);
+    pointsAfter += after;
+    capTrims += Math.max(0, before - after);
+  }
+
+  LOG.info(`reconcile dryRun=${dryRun} clusters=${slice.length} merges=${merges} pointsBefore=${pointsBefore} pointsAfter=${pointsAfter} capTrims=${capTrims}`);
+  return { clusters: slice.length, merges, pointsBefore, pointsAfter, capTrims, executed: !dryRun };
+}
+
+// Dry-run helper: project the post-merge per-event total under the 100-cap,
+// without mutating. Groups the cluster's awards by (event, awardDate), sums
+// per day to the 5-cap, then clamps each event to 100. Returns {total, trimmed}.
+async function projectCappedTotal(CatGameAwards, clusterIds) {
+  if (!clusterIds.length) return { total: 0, trimmed: 0 };
+  const rows = await SELECT.from(CatGameAwards).where({ user_ID: { in: clusterIds } });
+  const DAILY = 5, EVENT_CAP = 100;
+  const rawByEvent = {};       // event → sum of raw points
+  const perDay = {};           // `${event}|${day}` → summed-then-daily-capped
+  for (const r of rows) {
+    rawByEvent[r.event_ID] = (rawByEvent[r.event_ID] ?? 0) + (r.points ?? 0);
+    const k = `${r.event_ID}|${r.awardDate}`;
+    perDay[k] = Math.min((perDay[k] ?? 0) + (r.points ?? 0), DAILY);
+  }
+  const cappedByEvent = {};
+  for (const [k, pts] of Object.entries(perDay)) {
+    const ev = k.split('|')[0];
+    cappedByEvent[ev] = (cappedByEvent[ev] ?? 0) + pts;
+  }
+  let total = 0, trimmed = 0;
+  for (const ev of Object.keys(cappedByEvent)) {
+    const capped = Math.min(cappedByEvent[ev], EVENT_CAP);
+    total += capped;
+    trimmed += (rawByEvent[ev] ?? 0) - capped;
+  }
+  return { total, trimmed };
+}
diff --git a/srv/lib/resolve-db-user.js b/srv/lib/resolve-db-user.js
index 6b029580c..7cdcf15a2 100644
--- a/srv/lib/resolve-db-user.js
+++ b/srv/lib/resolve-db-user.js
@@ -13,3 +13,7 @@ export const issuerSubjectFromUser = mod.issuerSubjectFromUser;
 export const tokenEmail = mod.tokenEmail;
 export const writeIdentityLink = mod.writeIdentityLink;
 export const pinResolvedUser = mod.pinResolvedUser;
+// Added in #2651 — pickCanonicalRow is exported from the worktree/bundle
+// but the workspace symlink may point to a version that predates Task 2.
+// Export it here as the canonical re-export point for srv/jobs consumers.
+export const pickCanonicalRow = mod.pickCanonicalRow;
diff --git a/test/unit/identity-dedup-job.test.js b/test/unit/identity-dedup-job.test.js
new file mode 100644
index 000000000..2777717c2
--- /dev/null
+++ b/test/unit/identity-dedup-job.test.js
@@ -0,0 +1,159 @@
+// test/unit/identity-dedup-job.test.js
+//
+// Vitest/ESM tests for reconcileDuplicateEmails() (#2651).
+import { describe, it, expect, beforeAll } from 'vitest';
+import cds from '@sap/cds';
+
+// Boot CAP with in-memory SQLite once for this file.
+// SELECT / INSERT / DELETE / UPDATE become globals via cds.test().
+cds.test('serve', '--project', '.', '--in-memory');
+
+const { reconcileDuplicateEmails } = await import('../../srv/jobs/identity-dedup-job.js');
+
+describe('reconcileDuplicateEmails — dry-run batch dedup (#2651)', () => {
+  let Users, Events, EventRegistrations, CatGameAwards, SecondaryAccounts;
+
+  beforeAll(async () => {
+    await cds.connect.to('db');
+    ({ Users, Events, EventRegistrations, CatGameAwards, SecondaryAccounts } =
+      cds.entities('com.sap.developers.ims'));
+  });
+
+  // ─────────────────────────────────────────────────────────────────────────
+  // Case 1: Dry-run reports clusters WITHOUT mutating.
+  // ─────────────────────────────────────────────────────────────────────────
+  it('dry-run: reports cluster without mutating user rows', async () => {
+    const email = `dup-${cds.utils.uuid()}@x.io`;
+
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: cds.utils.uuid(),
+      email, legacyId: 1001, sapId: null,
+      createdAt: '2026-09-20T00:00:00Z',
+    });
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: cds.utils.uuid(),
+      email, legacyId: 1002, sapId: null,
+      createdAt: '2026-09-25T00:00:00Z',
+    });
+
+    const report = await reconcileDuplicateEmails({ dryRun: true });
+
+    expect(report.clusters).toBeGreaterThanOrEqual(1);
+    expect(report.merges).toBeGreaterThanOrEqual(1);
+    expect(report.executed).toBe(false);
+
+    // Row count must be unchanged (no mutation in dry-run)
+    const rowsAfter = await SELECT.from(Users).where({ email });
+    expect(rowsAfter.length).toBe(2);
+  });
+
+  // ─────────────────────────────────────────────────────────────────────────
+  // Case 2: Execute collapses the cluster.
+  // ─────────────────────────────────────────────────────────────────────────
+  it('execute: records MERGED in SecondaryAccounts, primary survives', async () => {
+    const email = `exec-${cds.utils.uuid()}@x.io`;
+    const primaryUuid = cds.utils.uuid();
+    const secondaryUuid = cds.utils.uuid();
+
+    // Older createdAt → pickCanonicalRow prefers the oldest as canonical primary
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: primaryUuid,
+      email, legacyId: 2001, sapId: null,
+      createdAt: '2026-09-20T00:00:00Z',
+    });
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: secondaryUuid,
+      email, legacyId: 2002, sapId: null,
+      createdAt: '2026-09-25T00:00:00Z',
+    });
+
+    const report = await reconcileDuplicateEmails({ dryRun: false });
+
+    expect(report.executed).toBe(true);
+    expect(report.merges).toBeGreaterThanOrEqual(1);
+
+    // SecondaryAccounts must have a MERGED record for secondaryUuid
+    const merged = await SELECT.from(SecondaryAccounts).where({ uuid: secondaryUuid });
+    expect(merged.length).toBeGreaterThanOrEqual(1);
+    expect(merged.some(r => r.status === 'MERGED')).toBe(true);
+
+    // Primary user still exists
+    const primary = await SELECT.from(Users).where({ uuid: primaryUuid });
+    expect(primary.length).toBe(1);
+  });
+
+  // ─────────────────────────────────────────────────────────────────────────
+  // Case 3: Point delta is real, not zero.
+  // Two users, same email, each with 5 pts on DISTINCT days → sum 10, no trim.
+  // ─────────────────────────────────────────────────────────────────────────
+  it('dry-run: pointsBefore/pointsAfter are real (10 pts, no cap trim)', async () => {
+    const email = `pts-${cds.utils.uuid()}@x.io`;
+
+    const uid1 = cds.utils.uuid();
+    const uid2 = cds.utils.uuid();
+
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: uid1,
+      email, legacyId: 3001, sapId: null,
+      createdAt: '2026-09-20T00:00:00Z',
+    });
+    await INSERT.into(Users).entries({
+      ID: cds.utils.uuid(), uuid: uid2,
+      email, legacyId: 3002, sapId: null,
+      createdAt: '2026-09-25T00:00:00Z',
+    });
+
+    const user1 = await SELECT.one.from(Users).where({ uuid: uid1 });
+    const user2 = await SELECT.one.from(Users).where({ uuid: uid2 });
+
+    const evId = cds.utils.uuid();
+    await INSERT.into(Events).entries({
+      ID: evId,
+      name: `DevtoberFest-pts-${evId}`,
+      eventType: 'DEVTOBERFEST',
+      startDate: '2026-09-21T00:00:00Z',
+      endDate: '2026-10-18T00:00:00Z',
+    });
+
+    // User1: 5 pts on day 2026-09-21
+    await INSERT.into(CatGameAwards).entries({
+      user_ID: user1.ID, event_ID: evId, awardDate: '2026-09-21', points: 5,
+    });
+    // User2: 5 pts on a DISTINCT day 2026-09-22
+    await INSERT.into(CatGameAwards).entries({
+      user_ID: user2.ID, event_ID: evId, awardDate: '2026-09-22', points: 5,
+    });
+
+    const report = await reconcileDuplicateEmails({ dryRun: true, limit: 1000 });
+
+    // Find this specific cluster's contribution
+    // The report aggregates across ALL clusters; we can only assert that the
+    // totals are at least the values from this cluster (other clusters may exist
+    // from earlier tests).
+    expect(report.pointsBefore).toBeGreaterThanOrEqual(10);
+    expect(report.pointsAfter).toBeGreaterThanOrEqual(10);
+    // capTrims may be 0 or more depending on other clusters, but for 2 distinct
+    // days with 5 pts each (total 10, well under 100-cap) there is no trim from
+    // this cluster — just assert fields are not all-zero (real computation ran)
+    expect(report.pointsBefore).toBeGreaterThan(0);
+    expect(report.executed).toBe(false);
+  });
+
+  // ─────────────────────────────────────────────────────────────────────────
+  // Case 4: limit caps cluster count.
+  // ─────────────────────────────────────────────────────────────────────────
+  it('limit: restricts cluster count to exactly 1', async () => {
+    // Insert two fresh dup-email clusters so we know at least 2 are available.
+    for (let i = 0; i < 2; i++) {
+      const email = `limit-${cds.utils.uuid()}@x.io`;
+      await INSERT.into(Users).entries([
+        { ID: cds.utils.uuid(), uuid: cds.utils.uuid(), email, legacyId: 4001 + i * 2 },
+        { ID: cds.utils.uuid(), uuid: cds.utils.uuid(), email, legacyId: 4002 + i * 2 },
+      ]);
+    }
+
+    const report = await reconcileDuplicateEmails({ dryRun: true, limit: 1 });
+
+    expect(report.clusters).toBe(1);
+  });
+});

From d358a3ea869baa4e4647791f902f91211508226c Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 14:47:14 -0400
Subject: [PATCH 17/19] fix(core): export pickCanonicalRow from package barrel
 (#2651)

---
 packages/core/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/core/index.js b/packages/core/index.js
index 973d8a3c0..ebabe9592 100644
--- a/packages/core/index.js
+++ b/packages/core/index.js
@@ -73,7 +73,7 @@ export { toBuffer } from './buffers.js';
 // recompute-tutorial-progress.js
 export { recomputeTutorialProgress } from './recompute-tutorial-progress.js';
 // resolve-db-user.js (moved T8)
-export { resolveUserSapId, resolveDbUser, emailFromUser, backfillUserProfile, provisionDbUser, resolveUser, issuerSubjectFromUser, tokenEmail, writeIdentityLink, pinResolvedUser } from './resolve-db-user.js';
+export { resolveUserSapId, resolveDbUser, emailFromUser, backfillUserProfile, provisionDbUser, resolveUser, issuerSubjectFromUser, tokenEmail, writeIdentityLink, pinResolvedUser, pickCanonicalRow } from './resolve-db-user.js';
 // user-progress.js (moved T8)
 export { getUserProgress, getMyCompletedTutorials, getMyCompletedTutorialsForPoints, getMyInProgressTutorials, getProgressLookup } from './user-progress.js';
 // tutorial-markdown.js (moved T8) — re-export all 4 named exports

From ef214a448f7a0218ac5f4edaa5c79f79680b15bc Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 14:53:01 -0400
Subject: [PATCH 18/19] fix(identity): tag __hasRegistration in Tier-3 so
 resolver and reconcile job pick same canonical row (#2651)

---
 packages/core/resolve-db-user.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/packages/core/resolve-db-user.js b/packages/core/resolve-db-user.js
index 9c29627f7..f2ae73060 100644
--- a/packages/core/resolve-db-user.js
+++ b/packages/core/resolve-db-user.js
@@ -306,6 +306,14 @@ export async function resolveUser(user, db) {
       (r) => r.email && !NOREPLY_GITHUB_RE.test(r.email),
     );
     if (candidates.length) {
+      // Tag registration-bearing rows so pickCanonicalRow prefers them — the
+      // same tagging the reconciliation job applies, so login-canonical and
+      // job-canonical agree on which row wins for a cluster (#2651).
+      const { EventRegistrations } = cds.entities('com.sap.developers.ims');
+      for (const c of candidates) {
+        const reg = await run(SELECT.one.from(EventRegistrations).where({ user_ID: c.ID }));
+        c.__hasRegistration = !!reg;
+      }
       const row = pickCanonicalRow(candidates);
       if (isu) {
         await writeIdentityLink(row.ID, isu, {

From 07b6832baf567a83eeac46b5f78c041a2d41a0f7 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Mon, 5 Oct 2026 15:58:14 -0400
Subject: [PATCH 19/19] chore(release): 1.36.0

Bump deploy version 1.35.0 -> 1.36.0 (.deploy/mta.yaml) for the DEV->main
promotion and update the user-facing What's New digest (hugo/data/whats_new.json)
with the 10 PRs merged since the 1.35.0 release cutoff (2026-10-04T22:06Z).

Headline items in this train:
- PROD Admin UI outage fixed + prevented recurrence: repinned SAPUI5 off a
  purged CDN version onto current LTS (#2658), and collapsed the version to a
  single source of truth with a CI drift gate (#2659).
- A2A production auth fixed: label-based XSUAA resolution so IAS-only M2M
  clients stop 401'ing (#2657).
- Sign-in / identity: SAP ID moved to top of provider list (#2652), mismatched
  social-login warning (#2653), and the duplicate-Users resolver fix that
  unforks Devtoberfest points/leaderboard (#2661).
- Reliability: unbroke Docs Deploy + a unit-test flake (#2660); content-rebuild
  allow-revert input to clear #672-guarded source-hash drift (#2655/#2656).
- Includes the 1.35.0 promotion PR (#2648) swept in just after its own cutoff.

whats_new.json is the committed changelog source; srv/whats-new-data/ is
rebuilt at build time and stays gitignored (not committed here).
---
 .deploy/mta.yaml         |   2 +-
 hugo/data/whats_new.json | 132 ++++++++++++++++++++++++++++++++++++++-
 2 files changed, 132 insertions(+), 2 deletions(-)

diff --git a/.deploy/mta.yaml b/.deploy/mta.yaml
index 95c1f44aa..a323a99ae 100644
--- a/.deploy/mta.yaml
+++ b/.deploy/mta.yaml
@@ -10,7 +10,7 @@ ID: tutorials-ims
 # Bump this on each release you deploy — it's the version shown by `cf mtas`
 # and in the mtar filename (tutorials-ims_<version>.mtar). Deploy is manual:
 # `cd .deploy && mbt build && cf deploy mta_archives/tutorials-ims_<version>.mtar -e ../deploy/<env>.mtaext -f`.
-version: 1.35.0
+version: 1.36.0
 
 # Top-level parameters (overridable per-env via deploy/<env>.mtaext).
 parameters:
diff --git a/hugo/data/whats_new.json b/hugo/data/whats_new.json
index 3b4435ecf..c67790d45 100644
--- a/hugo/data/whats_new.json
+++ b/hugo/data/whats_new.json
@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-10-04T22:06:26.850Z",
+  "generatedAt": "2026-10-05T19:57:38.652Z",
   "repos": [
     {
       "key": "tutorials-ims",
@@ -8,6 +8,136 @@
     }
   ],
   "entries": [
+    {
+      "id": "tutorials-ims#2657",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2657,
+      "title": "fix(a2a): resolve prod /a2a 401 — label-based XSUAA resolution + IAS-only degrade (#2649)",
+      "summary": "Fixed authentication on the agent-to-agent endpoint so machine-to-machine clients can connect reliably in production.",
+      "category": "Fix",
+      "mergedAt": "2026-10-05T19:02:11Z",
+      "week": "2026-W41",
+      "weekStart": "2026-10-05",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2657"
+    },
+    {
+      "id": "tutorials-ims#2661",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2661,
+      "title": "fix(identity): resolve + reconcile duplicate Users rows — cat-game counter/leaderboard desync (#2651)",
+      "summary": "Signing in with SAP ID no longer creates a duplicate profile, so your Devtoberfest points and leaderboard standing stay in sync.",
+      "category": "Fix",
+      "mergedAt": "2026-10-05T19:01:45Z",
+      "week": "2026-W41",
+      "weekStart": "2026-10-05",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2661"
+    },
+    {
+      "id": "tutorials-ims#2660",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2660,
+      "title": "fix(ci): unbreak Docs Deploy + unit tests",
+      "summary": "Fixed broken documentation builds and a flaky search test to keep the platform's quality checks green.",
+      "category": "Fix",
+      "mergedAt": "2026-10-05T18:19:45Z",
+      "week": "2026-W41",
+      "weekStart": "2026-10-05",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2660"
+    },
+    {
+      "id": "tutorials-ims#2659",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2659,
+      "title": "Single source of truth for the Admin UI's SAPUI5 version",
+      "summary": "The Admin UI's SAPUI5 version now lives in one place with an automatic drift check, so a future version bump can't silently break the admin tools.",
+      "category": "Maintenance",
+      "mergedAt": "2026-10-05T17:51:56Z",
+      "week": "2026-W41",
+      "weekStart": "2026-10-05",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2659"
+    },
+    {
+      "id": "tutorials-ims#2658",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2658,
+      "title": "fix(admin): UI5 CDN pin 1.136.0 → 1.148.12 — PROD Admin UI outage",
+      "summary": "Restored the Admin UI after an SAPUI5 version was removed from SAP's CDN, repinning to the current long-term-support release.",
+      "category": "Fix",
+      "mergedAt": "2026-10-05T17:27:38Z",
+      "week": "2026-W41",
+      "weekStart": "2026-10-05",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2658"
+    },
+    {
+      "id": "tutorials-ims#2656",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2656,
+      "title": "feat(rebuild-content): add allow-revert input to clear #672-guarded source-hash drift",
+      "summary": "Added an option to the content-rebuild workflow that clears a stuck content-drift check.",
+      "category": "Maintenance",
+      "mergedAt": "2026-10-05T14:49:12Z",
+      "week": "2026-W41",
+      "weekStart": "2026-10-05",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2656"
+    },
+    {
+      "id": "tutorials-ims#2655",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2655,
+      "title": "feat(rebuild-content): add allow-revert input to clear #672-guarded source-hash drift",
+      "summary": "Added an option to the content-rebuild workflow that clears a stuck content-drift check.",
+      "category": "Maintenance",
+      "mergedAt": "2026-10-05T14:06:30Z",
+      "week": "2026-W41",
+      "weekStart": "2026-10-05",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2655"
+    },
+    {
+      "id": "tutorials-ims#2653",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2653,
+      "title": "feat(signin): warn SAP-ID holders a mismatched social login forks progress #2651",
+      "summary": "The sign-in screen now warns SAP ID holders that choosing a different social login can fork their progress onto a separate profile.",
+      "category": "Feature",
+      "mergedAt": "2026-10-05T13:13:28Z",
+      "week": "2026-W41",
+      "weekStart": "2026-10-05",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2653"
+    },
+    {
+      "id": "tutorials-ims#2652",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2652,
+      "title": "feat(signin): move SAP ID to top of provider list",
+      "summary": "Continue with SAP ID now appears first on the sign-in screen, ahead of the other login providers.",
+      "category": "Feature",
+      "mergedAt": "2026-10-05T10:39:29Z",
+      "week": "2026-W41",
+      "weekStart": "2026-10-05",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2652"
+    },
+    {
+      "id": "tutorials-ims#2648",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2648,
+      "title": "Release 1.35.0 promoted to production",
+      "summary": "Shipped the 1.35.0 release train, restoring developer-portal sign-in and moving agent-to-agent authentication onto SAP IAS.",
+      "category": "Maintenance",
+      "mergedAt": "2026-10-04T22:17:01Z",
+      "week": "2026-W40",
+      "weekStart": "2026-09-28",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2648"
+    },
     {
       "id": "tutorials-ims#2647",
       "repo": "tutorials-ims",