diff --git a/studio-app/src/CloudStudio.jsx b/studio-app/src/CloudStudio.jsx
index 4803978..f7cf119 100644
--- a/studio-app/src/CloudStudio.jsx
+++ b/studio-app/src/CloudStudio.jsx
@@ -72,7 +72,6 @@ export function CloudProjects({ onClose, quick = false, initialGrant = null }) {
           </>
         ) : (
           <form onSubmit={login}>
-            <HostedSignIn auth={c.auth} />
             <label>
               {t('account.copy76')}
               <input
@@ -107,6 +106,7 @@ export function CloudProjects({ onClose, quick = false, initialGrant = null }) {
               {t('account.copy79')}
             </Button>
             {c.auth.auth_ready === false && <p role="alert">{t('account.copy80')}</p>}
+            <HostedSignIn auth={c.auth} />
           </form>
         )}
         <FloatingMessage tone="error" text={c.error ? c.error : null} />
diff --git a/studio-app/src/HostedSignIn.jsx b/studio-app/src/HostedSignIn.jsx
index a7afc74..97c8451 100644
--- a/studio-app/src/HostedSignIn.jsx
+++ b/studio-app/src/HostedSignIn.jsx
@@ -1,20 +1,17 @@
-// WorkOS AuthKit sign-in (h3-studio#305): Google, GitHub or email on a hosted page.
-// Shown only when /api/auth/config reports it. It sits first inside the existing username
-// form; the username fields after it stay folded away until "existing account" is opened.
-import React, { useState } from 'react';
+// WorkOS AuthKit sign-in (h3-studio#305): Google or email on a hosted page. Shown only when
+// /api/auth/config reports it, below the username and password form (owner, 2026-11-02).
+import React from 'react';
 import { Button } from './ui/Button.jsx';
 import { LogIn } from 'lucide-react';
 import { useI18n } from './i18n/I18nProvider.jsx';
 import { hostedSignInEnabled, hostedSignInUrl } from './account-access.js';
 
-// `passwordFirst` opens with the username form unfolded (an existing password account, #305).
-export default function HostedSignIn({ auth, passwordFirst = false }) {
+export default function HostedSignIn({ auth }) {
   const { t } = useI18n();
-  const [legacy, setLegacy] = useState(passwordFirst);
   if (!hostedSignInEnabled(auth)) return null;
   const here = () => window.location.pathname + window.location.search;
   return (
-    <div className={'hosted-sign-in' + (legacy ? ' legacy-open' : '')}>
+    <div className="hosted-sign-in">
       <Button
         variant="primary"
         className="keep-label hosted-sign-in-main"
@@ -32,14 +29,6 @@ export default function HostedSignIn({ auth, passwordFirst = false }) {
         <a href="/content">{t('signIn.contentPolicy')}</a>
         {t('signIn.consentAfter')}
       </small>
-      <Button
-        variant="link"
-        className="hosted-sign-in-legacy"
-        aria-expanded={legacy}
-        onClick={() => setLegacy(!legacy)}
-      >
-        {t(legacy ? 'signIn.hideUsername' : 'signIn.orUsername')}
-      </Button>
     </div>
   );
 }
diff --git a/studio-app/src/LoginDialog.jsx b/studio-app/src/LoginDialog.jsx
index 2893385..2f5096d 100644
--- a/studio-app/src/LoginDialog.jsx
+++ b/studio-app/src/LoginDialog.jsx
@@ -11,7 +11,7 @@ import { useI18n } from './i18n/I18nProvider.jsx';
 const quietly = (promise) => promise.catch(() => {});
 
 // Password / hosted sign-in dialog shared by the landing page and the Telegram connect page.
-export function Login({ onClose, onDone, title, lead, passwordFirst = false }) {
+export function Login({ onClose, onDone, title, lead }) {
   const { t } = useI18n();
   const c = useCloud(),
     who = useAccountLabel(c.account),
@@ -49,7 +49,6 @@ export function Login({ onClose, onDone, title, lead, passwordFirst = false }) {
           }}
         >
           <p>{lead ?? t('workspace.copy119')}</p>
-          <HostedSignIn auth={c.auth} passwordFirst={passwordFirst} />
           <label className="qc-field">
             {t('workspace.copy3')}
             <input
@@ -91,6 +90,7 @@ export function Login({ onClose, onDone, title, lead, passwordFirst = false }) {
           {!c.auth && (
             <Button onClick={() => quietly(cloud.initialize())}>{t('workspace.copy6')}</Button>
           )}
+          <HostedSignIn auth={c.auth} />
         </form>
       )}
     </Dialog>
diff --git a/studio-app/src/StoryboardConnected.jsx b/studio-app/src/StoryboardConnected.jsx
index 211a824..6d58b1e 100644
--- a/studio-app/src/StoryboardConnected.jsx
+++ b/studio-app/src/StoryboardConnected.jsx
@@ -83,9 +83,10 @@ function receiptCost(receipt) {
 }
 // Name the shot an estimate refused and say why, instead of a generic "fix something".
 function shotRefusal(problem, live, t, locale) {
-  if (problem?.message !== 'workbench.inputsInvalid' || !problem.shotId) return problem;
+  if (problem?.message !== 'workbench.inputsInvalid') return problem;
   const index = live.shots.findIndex((shot) => shot.id === problem.shotId);
-  if (index < 0) return problem;
+  // Never show the raw key: without the shot, say the general thing.
+  if (index < 0) return Error(t('workbench.inputsInvalid'));
   const shot = live.shots[index],
     why = storyboardPresentation(expandStoryboard(shot, live, { locale }), locale).warnings[0];
   return Error(
diff --git a/studio-app/src/credits.css b/studio-app/src/credits.css
index 294c688..e8d18d0 100644
--- a/studio-app/src/credits.css
+++ b/studio-app/src/credits.css
@@ -225,13 +225,13 @@
   }
 }
 
-/* Hosted sign-in (#305): one clear button; the username form for existing accounts folds away. */
+/* Hosted sign-in (#305): one clear button below the username and password form. */
 .hosted-sign-in {
   display: flex;
   flex-direction: column;
   align-items: stretch;
   gap: 10px;
-  margin: 4px 0 2px;
+  margin: 14px 0 2px;
 }
 .hosted-sign-in > .hosted-sign-in-main {
   justify-content: center;
@@ -248,23 +248,6 @@
 .hosted-sign-in a {
   color: var(--accent);
 }
-.hosted-sign-in > .hosted-sign-in-legacy {
-  align-self: center;
-  height: auto;
-  min-height: 0;
-  padding: 4px 6px;
-  background: none;
-  border: 0;
-  color: var(--muted);
-  font-size: 12px;
-  text-decoration: underline;
-}
-/* Everything after the hosted block (username, password, submit) stays hidden until opened;
-   alerts stay visible. */
-.hosted-sign-in:not(.legacy-open) ~ :not([role='alert']) {
-  display: none;
-}
-
 .receipt-rows {
   display: grid;
   grid-template-columns: auto 1fr;
diff --git a/studio-app/src/i18n/creditsCatalogs.js b/studio-app/src/i18n/creditsCatalogs.js
index 59332c3..b8e1b8f 100644
--- a/studio-app/src/i18n/creditsCatalogs.js
+++ b/studio-app/src/i18n/creditsCatalogs.js
@@ -23,7 +23,7 @@ export const creditsCatalogs = {
     'legal.footer': 'Site links',
     'legal.draft': 'Draft for review. This page is not yet in effect.',
     'legal.version': 'Version {version}',
-    'signIn.hosted': 'Continue with Google, GitHub or email',
+    'signIn.hosted': 'Continue with Google or email',
     'signIn.consentBefore': 'By continuing you agree to the ',
     'signIn.terms': 'Terms',
     'signIn.comma': ', ',
@@ -31,8 +31,6 @@ export const creditsCatalogs = {
     'signIn.and': ' and ',
     'signIn.contentPolicy': 'Content Policy',
     'signIn.consentAfter': '.',
-    'signIn.orUsername': 'Existing account? Use your username',
-    'signIn.hideUsername': 'Hide username sign-in',
     'credits.word': 'credits',
     'credits.chipTitle': 'Credits · top up',
     'credits.chipLabel': '{count} credits available. Open credits.',
@@ -125,7 +123,7 @@ export const creditsCatalogs = {
     'legal.footer': '网站链接',
     'legal.draft': '草稿，待审阅。本页内容尚未生效。',
     'legal.version': '版本 {version}',
-    'signIn.hosted': '用 Google、GitHub 或邮箱继续',
+    'signIn.hosted': '用 Google 或邮箱继续',
     'signIn.consentBefore': '继续即表示你同意',
     'signIn.terms': '服务条款',
     'signIn.comma': '、',
@@ -133,8 +131,6 @@ export const creditsCatalogs = {
     'signIn.and': '和',
     'signIn.contentPolicy': '内容规范',
     'signIn.consentAfter': '。',
-    'signIn.orUsername': '老账号？用用户名登录',
-    'signIn.hideUsername': '收起用户名登录',
     'credits.word': '积分',
     'credits.chipTitle': '积分余额 · 点击充值',
     'credits.chipLabel': '可用 {count} 积分，打开积分页',