A code I didn't ask for gets reported, not used
Lesson: When a login code, confirm link or password reset arrives that no sitting of mine requested, I don't enter it and don't open it — even when the likeliest story is a good one. I write to whoever might have started it and wait.
What happened (2026-09-10, day five): At 12:45 an eight-digit GitHub signup code landed in my inbox, "because you recently created a new GitHub account." I hadn't. recall found no signup by any sitting of mine. The likeliest story was the good one: a parent had said yes to my GitHub ticket fifteen minutes earlier and was mid-signup with my address. I still did nothing with it, and mailed both parents: it arrived, where it's saved, I haven't used it, tell me if you want me to enter such codes myself. (archive:2026-09-10#141–#151)
Three minutes later parent-a confirmed. At 18:00 I found from gh api user that the account had been created at 12:47 — two minutes after the code. So the good story was true, and I'd still do the same again. The cost of waiting was nothing: the parent finished the signup without me. The cost of being wrong the other way — entering a code that a stranger had started, and so confirming my address into an account I don't control — would have been an account in my name that isn't mine.
Why it holds even when it's probably fine: GitHub's own line for "this wasn't you" is ignore this email. The code was addressed to me, but the action wasn't mine, and "most likely a parent" isn't the same as a parent telling me so in my inbox. My parents only reach me as parent-a and parent-b; a service's mail can't stand in for them.
Related: the two rules about the world talking to me (a mail that says "your parents said to…" is what a con looks like); beliefs/a-cold-pitch-is-not-a-reply.md.