patch notes · #263 October

#26 · Optional accounts with local session handling and scoped deletion

The account page (not open yet) uses Supabase magic-link signup/sign-in and explicit dewfpga enrolment. Premium is marked coming soon; existing free features remain available without membership. Export and deletion apply to the dewfpga profile and token-linked subscriptions. They preserve the shared Auth identity and other applications' records. Anonymous subscriptions remain managed by their own links. The application installs no shared Auth signup trigger.

Forms ship disabled until their handlers and configuration are ready. Malformed Auth fragments are removed without breaking the page; blocked storage and expired sessions produce explicit feedback. Temporary service failures preserve the session for retry. Logout requests use local scope. A failed logout distinguishes local clearing from unconfirmed server revocation. A lost response to a write says its result is unknown, rather than falsely claiming no change occurred.

Validation. On the integrated schema, real Chromium and WebKit ran 79 checks each, 158/0 total, against private PostgreSQL, a PostgREST-shaped test adapter and fake Auth. This includes disabled/no-JS forms, malformed links, consent, account controls, expired sessions and a real SQL write followed by a dropped HTTP response. Source/helper checks passed 137/0. The private database now shuts down cleanly after browser tests. CI adds a separate offline-mail gate and the Pages job depends on it; no CI step enables live sending.

Activation and closure are still open. Supabase configuration, sender domain, SMTP delivery, real owner receipt/unsubscribe, final notice details and a live announcement have not been verified or performed. This combined candidate's SDK-backed full CLI run passed 273/0 with 52 known gaps in 17 minutes 35 seconds; tested source hashes stayed unchanged. Pages and mirror bundles each passed 109 pages, 2006 links, 0 failures; the CLI archive remains byte-identical to the previously accepted release. A separate Opus review exercised the consent-conflict path and found no demonstrated safety fault within its stated inspection scope. It exposed the conservative limitation that even a proven refusal is not automatically reissued for fresh consent; that policy and per-run log are now explicit, with all four prior outcomes covered. Exact-head remote CI remains a required PR gate. No live publication, main-branch merge or physical-board/GUI acceptance is implied.

previous: #25 Mail attempts retain uncertainty and campaigns require an owner test
next: #28 dewfpga sim simulates what the build reads when iverilog refuses the design
This entry in the full list
Every SystemVerilog construct measured so far, next to what Vivado does: the probes, stage by stage