- Shipped
- November 13, 2026 at 8:13 AM UTC
- Author
- Kamo
- Commit
- a6d39dc
**************** is now the one rule for a borrower's own account (portal merge/promote and borrower self-create, which the loan-party guard keys on): 1. the account they already own or belong to — unchanged; 2. once their e-mail is PROVEN, the org's account holding that address if it belongs to nobody — e.g. the account the external-MLOS loan sync made for their Arive loans. Reading the mailbox is what makes those loans theirs. Another person's account is never taken; 3. else a new account owned by them, carrying their address only when proven (then the leads with that address join it). hasProvenEmail = users.email_verified AND a used email_verification_tokens row: the flag alone is not proof — the borrower portal set it on every sign-up, sending nothing, until this change (SecurityService follows). Indexed: **************** **************** delegates to it.