Remove account merge event handling (#395)

ddiff --git a/server/revocations.js b/server/revocations.js
iindex 40450e0..7cfe1d0 100644
---- a/server/revocations.js
++++ b/server/revocations.js
@@@ -7,15 +7,14 @@
   * MEDIA_INBOUND_EVENTS_SECRET (signature v2 only) and refused when it came through the proxy. A
   * delivery moves the person's cutoff (openvibe-sdk createPgRevocationStore: only ever forward, source
   * network only); user-auth.js then refuses their older tokens, so openvibe.media's navbar shows them
-- * signed out at once. The same endpoint takes network.subject.merged (ADR-029): a folded-in account's media objects
-- * move to the survivor (server/subject-merge.js), and network.account.export_requested / network.account.deleted (ADR-033):
++ * signed out at once. network.account.export_requested / network.account.deleted (ADR-033):
   * Media's export part, or the erasure of what the account owns (server/account-data.js). The subscriptions (one per topic) are created at boot when
   * EVENTS_URL, the service secret and MEDIA_INBOUND_EVENTS_SECRET are set (grant media events.subscription.manage).
   */
  const express = require('express');
  
  const TOPIC = 'network.user.token_valid_after';
--const TOPICS = [TOPIC, 'network.subject.merged', 'network.account.export_requested', 'network.account.deleted'];
++const TOPICS = [TOPIC, 'network.account.export_requested', 'network.account.deleted'];
  let store = null;
  function cutoffs() {
      if (!store) store = require('openvibe-sdk/auth').createPgRevocationStore(require('./db/database').getDb(), { table: 'token_revocations' });
@@@ -46,7 +45,7 @@ function handler() {
          }
          let outcome;
          try {
--            outcome = d.event.event_type === 'network.subject.merged' ? await require('./subject-merge').apply(d.event) : await cutoffs().apply(d.event);
++            outcome = await cutoffs().apply(d.event);
          } catch (e) {
              console.error(`[Revocations] ${d.event.event_type} failed:`, e.message);
              return res.status(500).json({ error: 'not applied' });
ddiff --git a/server/subject-merge.js b/server/subject-merge.js
ddeleted file mode 100644
iindex 9b91f7a..0000000
---- a/server/subject-merge.js
++++ /dev/null
@@@ -1,28 +0,0 @@
--'use strict';
--/**
-- * network.subject.merged → Media (roadmap WS-B task 5, ADR-029; Contracts 0.69.0). Two Network accounts became one:
-- * `from` is an alias of `into`. Media repoints what it owns by subject: media_objects.owner_subject from `from` to
-- * `into`, in one transaction, once per merge_id (subject_merges). VOD and clip rows name Live's user ids, which Live's
-- * own consumer handles. Arrives at POST /internal/events (server/revocations.js), signed and loopback-only.
-- */
--const SUBJECT_RE = /^usr_[0-9A-HJKMNP-TV-Z]{26}$/;
--const MERGE_RE = /^mrg_[0-9A-HJKMNP-TV-Z]{26}$/;
--const TOPIC = 'network.subject.merged';
--
--
--/** One envelope → 'merged' | 'unchanged' | 'ignored:<why>'. */
--async function apply(ev, { db = require('./db/database').getDb() } = {}) {
--    if (!ev || ev.event_type !== TOPIC) return 'ignored:type';
--    if (ev.source !== 'network') return 'ignored:source';
--    const p = ev.payload && typeof ev.payload === 'object' ? ev.payload : {};
--    if (!MERGE_RE.test(String(p.merge_id || '')) || !SUBJECT_RE.test(String(p.from || '')) || !SUBJECT_RE.test(String(p.into || '')) || p.from === p.into) return 'ignored:payload';
--    return await db.tx(async () => {
--        if (await db.prepare('SELECT 1 FROM subject_merges WHERE merge_id = ?').get(p.merge_id)) return 'unchanged';
--        const objects = (await db.prepare('UPDATE media_objects SET owner_subject = ? WHERE owner_subject = ?').run(p.into, p.from)).changes;
--        await db.prepare('INSERT INTO subject_merges (merge_id, from_subject, into_subject, objects) VALUES (?, ?, ?, ?)').run(p.merge_id, p.from, p.into, objects);
--        console.log(`[Merge] ${p.merge_id}: ${objects} object(s) now owned by the survivor`);
--        return 'merged';
--    });
--}
--
--module.exports = { apply, TOPIC };
ddiff --git a/test/revocations.test.js b/test/revocations.test.js
iindex 687ed90..a3770a1 100644
---- a/test/revocations.test.js
++++ b/test/revocations.test.js
@@@ -46,17 +46,6 @@ const http = require('http');
              assert.strictEqual(revocations.isRevoked({ subject_id: SUBJECT, iat: at / 1000 + 5 }), false, 'newer ones are fine');
              assert.strictEqual((await post(ev())).body.outcome, 'unchanged', 'a redelivery');
  
--            // network.subject.merged (ADR-029): the folded-in account's objects are the survivor's, once per merge.
--            const db = require('../server/db/database').getDb();
--            const FROM = 'usr_01J8Z3Q4R5S6T7V8W9X0Y1Z2B4', INTO = 'usr_01J8Z3Q4R5S6T7V8W9X0Y1Z2C5';
--            const obj = db.prepare("INSERT INTO media_objects (id, app_id, namespace, kind, owner_subject) VALUES (?, 'live', 'live', 'file', ?)");
--            await obj.run('med_01J8Z3Q4R5S6T7V8W9X0Y1Z2D6', FROM); await obj.run('med_01J8Z3Q4R5S6T7V8W9X0Y1Z2E7', FROM); await obj.run('med_01J8Z3Q4R5S6T7V8W9X0Y1Z2F8', SUBJECT);
--            const merged = (over = {}) => ev({ event_id: 'evt_01J8Z3Q4R5S6T7V8W9X0Y1Z2G9', event_type: 'network.subject.merged', payload: { merge_id: 'mrg_01J8Z3Q4R5S6T7V8W9X0Y1Z2H0', from: FROM, into: INTO, merged_at: '2026-09-27T21:00:00.000Z', initiated_by: 'person' }, ...over });
--            assert.strictEqual((await post(merged({ source: 'live' }))).body.outcome, 'ignored:source');
--            assert.strictEqual((await post(merged())).body.outcome, 'merged');
--            assert.deepStrictEqual((await db.prepare('SELECT owner_subject AS o, COUNT(*) AS n FROM media_objects GROUP BY o ORDER BY o').all()).map((r) => [r.o, r.n]), [[SUBJECT, 1], [INTO, 2]].sort());
--            assert.strictEqual((await post(merged())).body.outcome, 'unchanged', 'a redelivery moves nothing');
--            assert.strictEqual((await db.prepare('SELECT objects FROM subject_merges').get()).objects, 2);
              const src = fs.readFileSync(path.join(__dirname, '../server/user-auth.js'), 'utf8');
              assert.ok(/require\('\.\/revocations'\)\.isRevoked\(claims\)/.test(src), 'the site token check consults it');
  
@@@ -70,7 +59,7 @@ const http = require('http');
              };
              assert.strictEqual(await revocations.ensureSubscription({ fetchImpl: fake, log: { log() {} } }), 'created');
              assert.strictEqual(await revocations.ensureSubscription({ fetchImpl: fake, log: { log() {} } }), 'exists');
--            assert.deepStrictEqual(subs.map((s) => s.topic_pattern), [revocations.TOPIC, 'network.subject.merged', 'network.account.export_requested', 'network.account.deleted'], 'one subscription per topic, created once');
++            assert.deepStrictEqual(subs.map((s) => s.topic_pattern), [revocations.TOPIC, 'network.account.export_requested', 'network.account.deleted'], 'one subscription per topic, created once');
          } finally {
              srv.close();
              fs.rmSync(tmp, { recursive: true, force: true });