Sign-up's username and taken-email sentences live in one module, read by every way an account is made #5608

The two sign-up sentences now come from one new module, src/actions/signup_words.ts, which exports INVALID_USERNAME_MESSAGE ("Usernames are letters, digits, dots and dashes.") and EMAIL_TAKEN_MESSAGE ("That email already has an account."). No existing module owned these words: actions/signup.ts holds signup-policy settings, not refusal sentences. So this is a new module.

What moved:

• src/actions/first_admin.ts (FIRST_ADMIN_WORDS) and src/web/pages/signup-passkey.ts (WORDS) import both sentences.
• src/web/pages/claim.ts, src/web/pages/everyday.ts and src/web/pages/site.ts import the taken-email sentence.
• Each file changes only the lines the sentences were on, plus one import line. The wording is unchanged, so answers and pages are byte-for-byte the same.
• grep -rn under src/ now finds each sentence only in signup_words.ts.

What I chose not to do: site.ts has its own username sentence with different wording, "Usernames are letters, digits, dots, dashes." (no "and"). The issue says to change no wording, so I left it as it is. Pointing it at the shared constant would change the sign-up page's text, and it should be a separate issue if wanted.

Test: the new test/signup-words.test.ts checks that each exported sentence is non-empty. It also reads each of the five files as text and checks that none contains either sentence and that each imports signup_words.ts. If a copy is typed back, it fails.

Checks run before pushing:

• bun x tsc --noEmit is clean.
• bun scripts/design-lint.ts is clean.
• bun test passed 94 of 94 across the new test and the first-admin, claim-link, everyday, signup, signup-passkey, signup-password and forge-signin-signup suites, with none failing.

To try it: bun test test/signup-words.test.ts, then grep -rn "That email already has an account" src/.

🤖 Generated with Claude Code

Closes #5592

The two sign-up sentences now come from one new module, src/actions/signup_words.ts, which exports INVALID_USERNAME_MESSAGE ("Usernames are letters, digits, dots and dashes.") and EMAIL_TAKEN_MESSAGE ("That email already has an account."). No existing module owned these words: actions/signup.ts holds signup-policy settings, not refusal sentences. So this is a new module.

What moved:

• src/actions/first_admin.ts (FIRST_ADMIN_WORDS) and src/web/pages/signup-passkey.ts (WORDS) import both sentences.
• src/web/pages/claim.ts, src/web/pages/everyday.ts and src/web/pages/site.ts import the taken-email sentence.
• Each file changes only the lines the sentences were on, plus one import line. The wording is unchanged, so answers and pages are byte-for-byte the same.
• grep -rn under src/ now finds each sentence only in signup_words.ts.

What I chose not to do: site.ts has its own username sentence with different wording, "Usernames are letters, digits, dots, dashes." (no "and"). The issue says to change no wording, so I left it as it is. Pointing it at the shared constant would change the sign-up page's text, and it should be a separate issue if wanted.

Test: the new test/signup-words.test.ts checks that each exported sentence is non-empty. It also reads each of the five files as text and checks that none contains either sentence and that each imports signup_words.ts. If a copy is typed back, it fails.

Checks run before pushing:

• bun x tsc --noEmit is clean.
• bun scripts/design-lint.ts is clean.
• bun test passed 94 of 94 across the new test and the first-admin, claim-link, everyday, signup, signup-passkey, signup-password and forge-signin-signup suites, with none failing.

To try it: bun test test/signup-words.test.ts, then grep -rn "That email already has an account" src/.

🤖 Generated with Claude Code

Sign-up's invalid-username and taken-email sentences now live in one place, src/actions/signup_words.ts. Every way an account is made reads them from there (#5592).

This push merges main into the branch. The only conflict was in the imports of src/web/pages/signup-passkey.ts: this branch imports EMAIL_TAKEN_MESSAGE and INVALID_USERNAME_MESSAGE from signup_words.ts, and main added PASSKEY_EXPIRED, PASSKEY_REJECTED and PASSKEY_TAKEN from src/web/passkey-words.ts. The file uses all five, so it keeps both imports. src/web/pages/site.ts merged without a conflict.

The type check is clean, and the 91 sign-up, passkey and TUI sign-up tests pass, across 19 files. The full check was not run here; the forge runs it on this push.

🤖 Generated with Claude Code