Separate login and display identities

docs/DESIGN_SYSTEM.md

@@ -62,8 +62,19 @@ Use the spacing tokens for new components. Prefer `8px`, `12px`, and `20px` gaps
   the left and the actionable secure-access console on the right.
 - OAuth providers appear as connection nodes with a recognizable provider color;
   SHD orange remains reserved for the primary local action and navigation.
+- Linked identity nodes show provider display name, account handle or stable ID,
+  and an explicit textual `LINKED` state. Unlink controls sit beneath the node,
+  require credential confirmation, and remain disabled with an explanation when
+  unlinking would remove the user's only sign-in method.
+- ISAC user dossiers reuse the same linked-identity node. Administrative
+  unlinking requires a scoped identity-management capability, produces an audit
+  event, and must never remove the user's only available sign-in method.
 - On small screens, the split frame becomes a single column and account controls
   move before archival content.
+- Public display names and private login usernames are distinct. Display names
+  support normalized Unicode and relaxed visible characters; login usernames
+  remain unique, ASCII-only credentials and must never appear on public-facing
+  community surfaces. Authorized ISAC user operations may show both.
 
 ### Third-party identity buttons